Loading malware…
Sectop RAT, also known as ArechClient2, is a Windows remote access trojan used as a follow-on payload in multi-stage intrusion chains. It has been observed alongside other commodity malware families including Lumma Stealer, Remcos RAT, NetSupport RAT, and StealC, indicating use in access monetization and post-compromise operations rather than as a standalone initial vector.
Observed delivery patterns show Sectop RAT arriving after earlier-stage malware or social-engineering-driven loaders. It has been deployed in ClickFix campaigns associated with SmartApeSG, also tracked as ZPHP and HANEYMANEY, where victims are tricked into executing malicious commands from fake CAPTCHA prompts on compromised websites. It has also appeared after cracked-software lures that first delivered Lumma Stealer, and it has been referenced as a possible follow-on payload in malicious MSIX/App Installer campaigns tied to Storm-1113 and Storm-1674. Earlier related loader activity has also been reported delivering Sectop RAT through fake software update themes.
On infected systems, Sectop RAT has been observed as a 64-bit Windows DLL executed through rundll32 and in delivery packages that rely on DLL sideloading via legitimate executables. These patterns indicate an emphasis on defense evasion and flexible staging. In documented SmartApeSG infections, Sectop RAT was delivered late in the chain after multiple other payloads had already established footholds, consistent with a role in sustained remote access and broader post-exploitation activity.
The malware targets Windows environments. Reported victim exposure includes users reached through compromised websites, fake verification workflows, pirated software lures, and malicious software-installation ecosystems. Its repeated appearance in financially motivated malware delivery operations suggests use for attacker-controlled remote access after initial compromise, often in campaigns that also pursue credential theft and data theft through companion malware.
4 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
In this previous campaign, the bitbucket folder contained additional malwares such as Remcos, Sectop RAT, Lumma Stealer, Mars Stealer, and Darktrack RAT.
The group has been linked to past campaigns that delivered dangerous tools including NetSupport RAT, Remcos RAT, StealC, and Sectop RAT.
The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT, also known as ArechClient2.
The campaign, active as recently as March 24, 2026, delivered four separate malware payloads to a single infected host in one session: Remcos RAT, NetSupport RAT, StealC, and Sectop RAT, also known as ArechClient2.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
you will see there are quite a lot of words and patterns belonging to cryptocurrencies and the crypto ökosystem... All with some sort of Typosquatting. This smelled phishy.
SmartApeSG works by injecting malicious scripts into legitimate but already-compromised websites. When a user visits one of these sites, they are redirected to a fake CAPTCHA page.
A newly discovered supply chain attack has put thousands of e-commerce websites at risk after a popular third-party reviews widget was quietly turned into a malware delivery tool.
the sample is probably shared through one of the many Google Ads Campaigns which are currently ongoing, where threat actors register malicious websites, make them appear like official software pages, and then lure victims into downloading malicious software.
The outcome? A perfectly valid PE file... proves to be a legitimate AutoIT3 executable... After that, “Champion.exe.pif” executes “S”.
note the TCP Port 15647 and the “PowerShell get-process” calls for “avastui” and “avgui”.
shortly after we see a command-line task started with “cmd.exe /c cmd < 4”... after deobfuscating this, we get the following lines of cmd commands
In this incident, the SmartApeSG injected JavaScript behaved as a staged loader, and did not attempt to execute every action immediately.
Victims who passed these filters were shown a fake CAPTCHA or verification screen, a technique known as ClickFix. These prompts instructed users to open the Windows Run menu and paste a command that was already copied silently to their clipboard.
The fake CAPTCHA page carries ClickFix instructions that silently copy a malicious script into the user’s clipboard, prompting the victim to paste and execute it manually through the Windows Run dialog box.
Shown above: Sectop RAT persistent on an infected Windows host.
This did give further proof of a possible process injection through Process Hollowing: As initially expected, the AutoIT script injected some code into the legitimate “jsc.exe”.
Shown above: Sectop RAT persistent on an infected Windows host.
Upon opening it, we are greeted by tons of gibberish... most of it is trash code, which is included to confuse... The script had 10255 lines in this style... the binary was strongly obfuscated using flow-dependent mutations and flow-dependent variables
the Execution Parent of our Sample is actually a file called “obs-installer-setupx64–29.685.zip”... threat actors register malicious websites, make them appear like official software pages
This did give further proof of a possible process injection through Process Hollowing: As initially expected, the AutoIT script injected some code into the legitimate “jsc.exe”.
One of the more technically notable aspects of this campaign is how it hides harmful code inside packages that also contain legitimate software.
That command then pulled down a PowerShell script or HTML Application file, which installed a remote access tool or information stealer on the victim’s machine.
Run method: rundll32 [file path] ,LoadForm
The first thing that comes to the eye is the search for processes called “avastui” and “avgui” using the PowerShell get-process scriptlet.
it's clear that we are looking at a Credential Stealer. It fingerprints the system and then steals as much sensitive data as possible.
From the function names and some other artifacts, it's clear that we are looking at a Credential Stealer. It fingerprints the system and then steals as much sensitive data as possible.
The first thing that comes to the eye is the search for processes called “avastui” and “avgui” using the PowerShell get-process scriptlet.
The fake CAPTCHA page carries ClickFix instructions that silently copy a malicious script into the user’s clipboard, prompting the victim to paste and execute it manually through the Windows Run dialog box.
We also see the creation of a TCP Client, which is used for C2 Communication... Prior Analysis of this threat has shown very similar TTP: A connection via TCP/IP, a Connection to Port 15647, JSON-based communication
Besides, the script was also responsible for the initial DNS Query that was observed.
Follow-up malware... Retrieved from: hxxps[:]//enotsosun[.]pw/NetGui.dll Saved to: C:\Users\ [username] \AppData\Local\Temp\16XBPQ29ZBG94TYNOA.dll
Deploy remote access tools or information stealers.
tcp[:]//91.92.241[.]102:443/ - encoded or otherwise encrypted traffic (not HTTPS/TLS)
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.