SectopRAT Hidden Inside Legitimate Audio Software to Steal Passwords and Take Remote Control
Fortinet's incident responders found a powerful remote-access trojan tucked inside a tampered copy of a real audio program. The malware can grab browser passwords, watch your screen, and hand full control of a Windows PC to criminals.
Key points
- Fortinet's FortiGuard Incident Response team discovered a new variant of SectopRAT, a remote-access trojan first seen in 2019, hidden inside a legitimate digital audio workstation made by an Italian software company.
- Criminals tampered with the installer after it reached the victim's system, embedding the payload inside a database file and hijacking a legitimate code library called FrameworkBase.dll to quietly load it.
- SectopRAT can execute 29 separate remote commands, including capturing the screen, stealing browser passwords, and wiping its own traces once finished.
- Unlike earlier versions, which started communications in plain text before switching to encryption, this variant encrypts all traffic from the first connection using AES, a standard encryption algorithm, making it harder to detect on a network.
- Windows users are the only confirmed targets; no patch exists because no software vulnerability was exploited.
A remote-access trojan, or RAT, is malicious software that lets criminals operate a victim's computer as if they were sitting in front of it. SectopRAT is one of the more capable examples of the type, and Fortinet's analysis, published this week, shows it's quietly grown more dangerous.
How did the malware get onto the victim's computer?
Criminals tampered with a copy of a legitimate Windows audio application made by an Italian company. They didn't break into the software vendor's systems. Instead, they modified the application after installation, hiding the SectopRAT payload inside one of the program's database files and rewriting a legitimate code library to load the malicious code automatically when the software started.
Because the outer program was real and well-known, standard security checks were far less likely to flag it. FortiGuard researcher Xiaopeng Zhang, who led the analysis, told Dark Reading there's no evidence the criminals specifically targeted this Italian company; they appear to have picked its software because its reputation made the malware harder to spot.
SectopRAT has a history of this approach. Previous campaigns used a fake Notion installer, a modified version of the EarthTime mapping application, and the Ghostpulse malware loader dropped through ClickFix scams, where criminals create fake error messages that trick people into running harmful commands. As our 3 September story on infostealer session cookies showed, the real danger after a credential theft often arrives before a victim notices anything is wrong.
What can the malware actually do?
Fortinet catalogued 29 distinct commands the malware's control server can send, covering almost everything a human operator at the keyboard could do.
| Capability | Detail |
|---|---|
| Screen capture | Views the victim's screen in real time |
| Credential theft | Pulls saved passwords, cookies, and payment details from browsers |
| File and process control | Reads, moves, and deletes files; starts or kills running programs |
| Remote command execution | Runs any instruction on the machine |
| Self-deletion | Removes its own components to erase evidence |
| Cryptocurrency wallet access | Searches for wallet files and account data |
The malware also targets email clients and gaming service accounts, so the risk extends well beyond banking or work credentials.
Should Windows users be worried?
There's no software flaw to patch here, which is exactly what makes this kind of attack awkward. No security update closes the gap because the criminals exploited trust, not a vulnerability. The practical advice is behaviour-based: watch for any program doing things it has no reason to do.
If you downloaded audio production software recently, particularly from a source other than the vendor's official website, run a full scan with an up-to-date security tool. Check your browser's saved-password list and change passwords for banking and any cryptocurrency accounts as a precaution. Enable two-factor authentication, a second check such as a text-message code, on those accounts so a stolen password alone isn't enough to break in.
The malware itself isn't new. What keeps it effective is that the delivery method keeps working. People reasonably trust software they recognise, and until endpoint security tools start judging programs by what they actually do on a system rather than whether their name looks familiar, wrapping malware inside legitimate software will remain a reliable criminal tactic. That's the thing to watch: not the RAT, but whether the industry shifts from name-based trust to behaviour-based scrutiny.
