EndClient RAT Leverages Compromised Code-Signing to Slip Past Antivirus

A sophisticated Remote Access Trojan called EndClient RAT is targeting North Korean human rights defenders and uses a stolen code-signing certificate to bypass antivirus detection, according to PSCORE. The disclosure is the result of a collaborative investigation by independent security researchers and PSCORE, according to PSCORE.

The malware is delivered via a malicious Microsoft Installer package disguised as StressClear.msi, and the dropper had alarmingly low detection across engines, with only 7 of 64 engines flagging it. The attack chain began in September when threat actors breached a prominent North Korean HRD’s Google account and used KakaoTalk to distribute the AutoIT-based RAT to 39 additional targets, through one-to-one social engineering.

The code-signing certificate was issued by SSL[.]com EV Code Signing Intermediate CA RSA R3, valid from 25 October 2024 to 17 October 2025, enabling the malware to appear legitimate and avoid Windows SmartScreen alerts. The campaign also employs in-memory execution, a persistence mechanism via a scheduled task named IoKlTr, and a global mutex, with C2 communications to 116.202.99[.]218:443 using a custom JSON protocol.