RAT Service Spoofing via "Windows Real-time Protection Service"

Tim Peck@timpeck

•updated Dec 22, 2025•8•0•136

Detects the creation of a Windows service named "NSecRTS" with the display name "Windows Real-time Protection Service" and an executable path in a suspicious "NSEC" folder. This behavior is associated with a China-linked RAT observed in an Indian Income Tax-themed phishing campaign.