BotHelper RAT: From Encrypted Payload to Live Screen Surveillance

BotHelper RAT uses a stealthy multi-stage Windows infection chain to decrypt and disguise a .NET backdoor that evades defenses, persists via scheduled tasks, streams victims’ screens, executes commands, steals clipboard data, and loads additional payloads through easyllms[.]xyz.