Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2

Gbhackers •Mayura Kathir • August 26, 2026

A fake Claude Desktop installer campaign is using Bing malvertising to impersonate trusted Claude. ai-hosted content, DLL sideloading, and blockchain-based command-and-control to deploy the SectopRAT remote-access trojan. CyberProof researchers said an agent-led hunt scoped the full intrusion chain across endpoint telemetry in ten minutes, turning a single suspicious scheduled task into a confirmed multi-stage […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Fake Claude Installer Delivers SectopRAT via DLL Sideloading A campaign using a counterfeit Claude desktop installer is targeting Windows systems, employing DLL sideloading and blockchain-based command-and-control to deploy the SectopRAT remote-access trojan. The attackers disable Windows Defender and utilize Bing malvertising to impersonate trusted software, leading to credential theft and long-term access. CyberProof researchers identified the threat through an agent-led hunt, confirming the multi-stage intrusion within ten minutes. Organizations are urged to be vigilant about trusted-looking download pages that may harbor malicious files. The full scope of the impact is still being assessed, but the campaign poses a significant risk to affected users. 2 sources 65

Extracted Entities

Fake Claude Desktop Installer Deploys SectopRAT Using DLL Sideloading and Blockchain C2

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)