SectopRAT DLL sideload via fake ClaudeDesktop.exe / tampered libcef.dll

Ibrahim Saud@tektrix

•updated Sep 23, 2026•0•0•5

Detects a malicious payload masquerading as a ClaudeDesktop installer that uses DLL sideloading via a tampered libcef.dll and a repurposed JetBrains binary to execute the SectopRAT .NET RAT.