Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malware

Key facts for SectopRAT Bing ads lure

Detection coverage for SectopRAT Bing ads lure

As of 2026-07-23, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1662 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SectopRAT/ArechClient2 — EtherHiding Blockchain C2 Resolution + Known C2 Infrastructure + Credential/Cookie Theft (C2 / Lateral Movement)

Detects the SectopRAT C2 channel: outbound blockchain-RPC-shaped connections (ports 443/8545) from a non-wallet, non-browser process toward BNB Smart Chain infrastructure used for EtherHiding C2 resolution, connections to the disclosed C2 domains/IPs (claude.ai.download-app[.]us backup infra, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, 2.24.131.246, and historical IPs 107.189.24.67/104.194.133.210/45.59.122.82), and subsequent local access to browser credential/cookie stores consistent with SectopRAT's info-stealer collection routine. Matters because EtherHiding resists conventional domain/IP takedown, so behavioral + known-infra detection is the durable control.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1102.002, T1568, T1041, T1555.003, T1539
• Data sources: proxy, firewall, sysmon
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR index=firewall sourcetype IN ("proxy:traffic","pan:traffic","stream:tcp")
(dest_ip IN ("2.24.131.246","107.189.24.67","104.194.133.210","45.59.122.82") OR dest_domain IN ("5ca8758c-02d0-4a72-89c8-d468b66dda41.com","claude.ai.download-app.us","downloading-api.it.com"))
| eval detection_category="known_c2_infra"
| append
    [ search index=proxy sourcetype="proxy:traffic" dest_port IN (443,8545)
      NOT (process_name="*MetaMask*" OR process_name="*wallet*" OR process_name="*chrome*" OR process_name="*firefox*" OR process_name="*msedge*")
      | eval detection_category="etherhiding_rpc_pattern" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      TargetFilename="*\\Login Data" OR TargetFilename="*\\Cookies" OR TargetFilename="*\\Web Data"
      NOT Image IN ("*\\chrome.exe","*\\msedge.exe","*\\firefox.exe")
      | eval detection_category="browser_credential_access" ]
| table _time host src_ip dest_ip dest_domain dest_port process_name Image TargetFilename detection_category
| sort -_time

Microsoft KQL

let knownC2Ips = dynamic(["2.24.131.246", "107.189.24.67", "104.194.133.210", "45.59.122.82"]);
let knownC2Domains = dynamic(["5ca8758c-02d0-4a72-89c8-d468b66dda41.com", "claude.ai.download-app.us", "downloading-api.it.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (knownC2Ips) or RemoteUrl has_any (knownC2Domains)
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, Category = "known_c2_infra"
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort in (443, 8545)
    | where InitiatingProcessFileName !has_any ("MetaMask", "wallet", "chrome.exe", "msedge.exe", "firefox.exe")
    | project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, Category = "etherhiding_rpc_pattern"
)
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Login Data", "Cookies", "Web Data")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe")
    | project Timestamp, DeviceName, RemoteIP = "", RemoteUrl = FolderPath, RemotePort = int(null), InitiatingProcessFileName, Category = "browser_credential_access"
)
| order by Timestamp desc

Sigma

title: SectopRAT EtherHiding C2 Resolution + Known C2 Infrastructure Contact
id: 9d2b5e4f-1a6c-4f8b-b230-fakeagent0003
status: experimental
description: Detects outbound connections to disclosed FakeAgent/SectopRAT C2 infrastructure and blockchain-RPC-shaped requests from non-wallet processes consistent with the EtherHiding C2-resolution technique.
references:
    - https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html
    - https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1102.002
    - attack.t1568
    - attack.exfiltration
    - attack.t1041
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.tool.sectoprat
logsource:
    category: network_connection
    product: windows
detection:
    selection_known_infra:
        DestinationIp:
            - '2.24.131.246'
            - '107.189.24.67'
            - '104.194.133.210'
            - '45.59.122.82'
    selection_rpc_pattern:
        DestinationPort:
            - 443
            - 8545
    filter_known_wallets:
        Image|contains:
            - 'MetaMask'
            - 'wallet'
            - 'chrome.exe'
            - 'msedge.exe'
            - 'firefox.exe'
    condition: selection_known_infra or (selection_rpc_pattern and not filter_known_wallets)
falsepositives:
    - Legitimate cryptocurrency wallet or dApp software performing genuine JSON-RPC calls to blockchain nodes on port 8545
level: medium

Known false positives:

• Legitimate cryptocurrency wallet, dApp, or blockchain node-operator software making genuine JSON-RPC calls over port 8545/443; browsers legitimately reading their own Login Data/Cookies/Web Data files

Tuning notes: Maintain the known-C2 IP/domain list against Huntress/BleepingComputer IOC updates as EtherHiding lets the operator rotate infrastructure without a new domain; narrow the RPC-port heuristic with a process-reputation/EDR-known-good allow-list to reduce noise from legitimate wallet software before enabling it in blocking mode.

• 🔒 FakeAgent — Counterfeit Claude/Docker Desktop Download from Non-Canonical Domain + Unsigned CEF DLL Load (Exploitation) · unlock with TL Creds
• 🔒 FakeAgent — [indicator] EdgeUpdate Masquerade + [indicator] Side-Load + DockerDesktop Scheduled Task (Post-Exploitation) · unlock with TL Creds
• 🔒 SectopRAT/ArechClient2 — EtherHiding Blockchain C2 + Known Infrastructure + Credential Store Access (C2 / Lateral Movement) · unlock with TL Creds
• 🔒 Sigma — Unsigned [indicator] Side-Loaded by Trusted-Named Process (FakeAgent Exploitation Stage) · unlock with TL Creds
• 🔒 Sigma — Dropper Masquerading Under EdgeUpdate AppData Path + DockerDesktop Scheduled Task (Post-Exploitation) · unlock with TL Creds
• 🔒 Sigma — Blockchain-RPC-Shaped Outbound Connection from Non-Wallet Process (EtherHiding C2 Pattern) · unlock with TL Creds
• 🔒 FakeAgent — Counterfeit ClaudeDesktop/DockerDesktop Installer Download + [indicator] Side-Load (Exploitation) · unlock with TL Creds
• 🔒 FakeAgent — [indicator]/[indicator] EdgeUpdate Masquerade + Anti-VM GPU Enumeration + Scheduled Task Persistence (Post-Exploitation) · unlock with TL Creds

Indicators of compromise for SectopRAT Bing ads lure

As of 2026-07-23, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-1662.

Sample indicators (3 of 27)

• IP address: 2.24.131[.]246
• Domain: claude[.]ai[.]download-app[.]us
• URL: hxxps://claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

How SectopRAT Bing ads lure works

The campaign ran July 21-22, 2026, generated 7,100 artifact page views/downloads, and compromised at least 29 organizations before removal.

The FakeAgent campaign (disclosed by Huntress and reported by BleepingComputer on 2026-07-23) is a multi-stage malvertising and DLL-sideloading operation that specifically impersonates the Anthropic Claude brand to distribute the SectopRAT information stealer. Victims searching Bing for 'Claude Desktop app' were served a sponsored ad linking to a public Claude Artifact hosted directly on claude.ai (claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877), lending the lure the legitimate domain's trust. The artifact redirected through claude.ai.download-app[.]us to downloading-api.it[.]com/html/claude/win, which served a trojanized ClaudeDesktop.exe.

Stage 1 (ClaudeDesktop.exe / DockerDesktop.exe) is a repackaged, VMProtect-packed copy of the legitimate JetBrains Chromium Embedded Framework helper (jcef_helper.exe) that sideloads a malicious libcef.dll. This stage resolves further instructions from an Ethereum BNB Smart Chain contract (0xc1907d7be91f95903ad66d775c397302e7dd9228) and downloads a secondary payload, cache.dat.

Stage 2 drops sslconf.exe (a repackaged IBM SPSS binary) to %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe, masquerading as a Microsoft Edge update artifact, alongside a maliciously modified tempdir.dll it sideloads. This stage performs extensive anti-analysis: DXGI GPU adapter enumeration to detect QEMU (0x1234) and VMware (0x15AD) virtual GPU signatures, VRAM threshold checks (<1GB triggers evasion), and DirectX compute-shader timing checks to detect sandboxes/emulation.

Stage 3 decrypts an encrypted payload (appcfg.dat) using a custom AES-256-CTR variant with a modified MixColumns Row 3 transform, with the decryption routine executed as an SM5 DirectX shader on the GPU itself to frustrate static/dynamic analysis. Huntress used Claude Opus 4.8 to assist in reconstructing the shader's cryptographic logic and recovering S-boxes from the compiled DXBC bytecode.

Stage 4 is the final SectopRAT (ArechClient2) .NET payload — a heavily obfuscated info-stealer/RAT active since 2019 that harvests browser logins, cookies, autofill data, credit card numbers, Chromium master keys, FTP credentials, and Discord/Telegram/Steam/VPN client credentials, and provides HVNC (Hidden VNC) for interactive, invisible remote-hands-on access to the victim host. Its C2 channel resolves through a second BNB Smart Chain contract (0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228) using the EtherHiding technique, which stores C2 addressing data inside blockchain transactions so the operator can rotate infrastructure by broadcasting a new transaction rather than standing up a new server, resisting conventional domain/IP takedown.

Persistence is maintained via a scheduled task tied to DockerDesktop.exe for periodic reinfection and via the disguised sslconf.exe under the EdgeUpdate path. Huntress could not attribute the campaign to a known threat cluster but linked the domain-registration email to at least 10 other malicious domains registered since December 2025, one of which (polse[.]us) previously distributed the StealC stealer and was seized by Microsoft/Europol during Operation Endgame. The same libcef.dll DLL-sideloading technique was reportedly used in an April 2026 malicious Docker Hub campaign by what may be the same operator. SectopRAT has separately been observed via CastleLoader campaigns and ClickFix-style fake-CAPTCHA lures, indicating it is actively distributed through multiple malvertising/social-engineering channels in parallel with this campaign.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1574 Hijack Execution Flow

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053 Scheduled Task/Job

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1568 Dynamic Resolution

Discovery

T1082 System Information Discovery; T1497 Virtualization/Sandbox Evasion

Initial Access

T1189 Drive-by Compromise

Execution

T1204 User Execution

Credential Access

T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1588 Obtain Capabilities

Reconnaissance

T1593 Search Open Websites/Domains

Remediation for SectopRAT Bing ads lure

Immediate actions

• Block/remove the identified C2 domains and IPs at DNS and network perimeter (claude.ai.download-app[.]us, downloading-api.it[.]com, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, 2.24.131.246)
• Hunt for the disclosed file hashes and filenames (ClaudeDesktop.exe, DockerDesktop.exe, sslconf.exe, libcef.dll, tempdir.dll, cache.dat, appcfg.dat) across endpoints
• Search for the malicious scheduled task associated with DockerDesktop.exe and remove it
• Inspect %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install\ for unauthorized sslconf.exe
• Force-rotate credentials/browser sessions on any host where the IOCs were found (browser passwords, cookies, Discord/Telegram/Steam/VPN/FTP credentials, stored payment cards)

Workarounds

• Disable or restrict execution of publicly shared Claude Artifacts that request the user download and run an executable
• Block search-ad-driven redirects to non-canonical claude.ai subdomains at the web proxy

Longer-term hardening

• Deploy EDR with DLL side-loading and unsigned-DLL-load detection for trusted third-party executables (JetBrains CEF, IBM SPSS binaries)
• Alert on outbound queries to Ethereum/BNB Smart Chain RPC endpoints from non-browser/non-wallet processes as a C2-channel indicator (EtherHiding)
• Monitor for DXGI GPU adapter enumeration paired with DirectX compute shader execution in non-graphics-intensive processes
• Restrict/monitor execution of software downloaded via sponsored search-engine ads; consider ad-blocking or DNS filtering for known malvertising redirector patterns
• Educate users that legitimate Claude Desktop installers only come from anthropic.com/claude.ai official download pages, never from public Artifact links

Affected and fixed versions

• Anthropic — Claude Desktop app (brand impersonated)
  Vulnerable versions: N/A - counterfeit installer impersonates the legitimate product
  Fixed in: N/A
• JetBrains — Chromium Embedded Framework helper (jcef_helper.exe / libcef.dll)
  Vulnerable versions: Legitimate binary abused as a DLL side-loading host
  Fixed in: N/A - vendor binary itself not vulnerable; abuse vector is unsigned DLL load order
• Microsoft — Windows (all supported desktop versions)
  Vulnerable versions: Any Windows host where the user executes ClaudeDesktop.exe/DockerDesktop.exe
  Fixed in: N/A

Timeline of SectopRAT Bing ads lure

• 2025-05-30 Historical SectopRAT C2 IP locked-ioc-17 active, per Huntress infrastructure timeline linked to the same operator cluster
• 2025-07-13 Historical SectopRAT C2 IP locked-ioc-16 active
• 2025-09-14 Historical SectopRAT C2 IP locked-ioc-19 active
• 2025-12-01 Operator begins registering the domain cluster (10+ domains under one registration email) later used in the FakeAgent campaign, including one (locked-ioc-26) later seized during Operation Endgame for StealC distribution
• 2026-04-01 A related malvertising campaign abusing Docker Hub uses the same locked-ioc-22 DLL side-loading technique, suggesting shared tooling/operator
• 2026-05-09 Redirector domain locked-ioc-11 registered
• 2026-06-12 Current SectopRAT C2 IP locked-ioc-18 becomes active
• 2026-07-21 FakeAgent campaign begins: sponsored Bing ads for 'Claude Desktop app' begin redirecting to a malicious public Claude Artifact hosted on claude.ai
• 2026-07-22 Campaign removed after generating 7,100 artifact page views/downloads and compromising at least 29 organizations
• 2026-07-23 Huntress publishes technical analysis; BleepingComputer, IT Security Guru, and GBHackers report on the FakeAgent campaign

Sources cited for SectopRAT Bing ads lure

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT Huntress · Vendor report · 2026-07-23
• Smart Contracts for Command and Control: How ClearFake Hid in Plain Sight on BSC Testnet Trend Micro · Research · 2026-05-01
• Fake CAPTCHAs, Smart Contracts, Real Risk: Unpacking a ClickFix Campaign Delivering SectopRAT blog.vega.io · Research · 2026-04-01
• Bing ad for NordVPN leads to SecTopRAT threatdown.com · Blog · 2026-07-23
• Fake Claude app promoted by Bing ads pushes SectopRAT malware BleepingComputer · News · 2026-07-23
• FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations itsecurityguru.org · News · 2026-07-23
• Bing Ads Exploited by Hackers to Spread SecTopRAT Through NordVPN Mimic gbhackers.com · News · 2026-07-23

Threats related to SectopRAT Bing ads lure

• FakeAgent Malvertising Campaign Distributes SectopRAT via Fake Claude Desktop Installer Hosted on claude.ai
• Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage
• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer
• StealC Infostealer and Amadey Loader Malware-as-a-Service Cybercrime Ecosystem (Operation Endgame Disruption)

Related coverage of this activity

• FakeAgent AI platform lures

Previous and next in malware

• Red Canary Intelligence Insights July 2026: ClearFake Leads Third Straight Month Amid CastleLoader Debut and Caret-Obfuscated Paste-and-Run Campaigns Previous report
• Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge Next report