CloudSEK's security researchers have uncovered a sophisticated malware campaign using fake PDF-to-DOCX conversion tools to infect unsuspecting users with a powerful information stealer. This comes just weeks after the FBI's Denver office issued a public alert warning of malicious online file converters being leveraged to deliver malware. The report reveals how cybercriminals have crafted deceptive websites, such as candyxpdf[.]com and candyconverterpdf[.]com, that meticulously mimic the legitimate pdfcandy.com service.

Fake PDFCandy sites using Google Ads spread ArechClient2 malware. #malware #phishing #cybersecurity

sectopRAT, also known as Arechclient2, is a highly obfuscated Remote Access Trojan (RAT) developed in .NET, leveraging advanced obfuscation techniques.

Last month we noticed a surprising payload combination in some paste and run (aka ClickFix and fakeCAPTCHA) campaigns: HijackLoader dropping the Arechclient2 RAT. 🐀 💡 Learn more about Arechclient2 and the rest of the month's top 10 threats in our April Intelligence Insights: https://t.co/TRLwhgIknY

Beware of PDFCandy.com's evil twin! Cybercriminals are impersonating this popular file converter to distribute the ArechClient2 malware. With a fake website and sneaky CAPTCHA, unsuspecting users fall into their trap. Stay alert and verify URLs to dodge this cunning scam.

<p><img src="https://www.sentinelone.com/wp-content/uploads/2023/07/RE-Walkthrough-Analyzing-A-Sample-Of-Arechclient2.jpg" alt="RE-Walkthrough-Analyzing-A-Sample-Of-Are"></p>Read more about <b>Cyber Security</b> · SentinelOne's <b>Cybersecurity</b> Predictions 2023 | What's Next? · Analyzing Attack Opportunities Against Information ...

Explore this post and more from the ReverseEngineering community

Introduction: The cybersecurity landscape faces yet another sophisticated attack chain, where Lumma Stealer infections escalate into full SectopRAT (ArechClient2) deployments. This malware campaign leverages deceptive downloads, persistence mechanisms, and command-and-control (C2) infrastructure to compromise victim machines. Below, we dissect the attack flow, provide actionable detection/mitigation steps, and analyze its implications. Learning Objectives: Understand the infection chain from Lumma Stealer to SectopRAT.

sectopRAT, also known as Arechclient2, is a highly obfuscated Remote Access Trojan (RAT) developed in .NET, leveraging advanced obfuscation techniques.

CloudSEK uncovers a sophisticated malware campaign where attackers impersonate PDFCandy.com to distribute the ArechClient2 information stealer. Learn how…