# Fake Claude Desktop App Promoted via Bing Ads Delivers SectopRAT (ArechClient2) Malware

> A malvertising campaign dubbed 'FakeAgent' abused a public Claude Artifact hosted on Anthropic's legitimate claude.ai domain, surfaced via sponsored Bing search ads for 'Claude Desktop app', to redirect victims to a counterfeit ClaudeDesktop.exe installer. The installer repackages a legitimate JetBrains CEF helper (jcef_helper.exe) and sideloads a malicious libcef.dll to deploy SectopRAT (ArechClient2), an info-stealing RAT with HVNC capability that uses the EtherHiding technique to retrieve its C2 address from Ethereum/BNB Smart Chain transactions. The campaign ran July 21-22, 2026, generated 7,100 artifact page views/downloads, and compromised at least 29 organizations before removal.

- **Published:** 2026-07-23T00:00:00Z
- **Last reviewed:** 2026-07-23T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1662
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sectoprat-bing-ads-lure-tl-2026-1662.webp?v=32b40788 (Threadlinqs threat intel: Fake Claude Desktop Drops SectopRAT: Detection & IOCs (TL-2026-1662) — High severity, 27 IOCs, 9 detection rules.)
- **ID:** TL-2026-1662
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 27 (3 shown free below)

## Description

The FakeAgent campaign (disclosed by Huntress and reported by BleepingComputer on 2026-07-23) is a multi-stage malvertising and DLL-sideloading operation that specifically impersonates the Anthropic Claude brand to distribute the SectopRAT information stealer. Victims searching Bing for 'Claude Desktop app' were served a sponsored ad linking to a public Claude Artifact hosted directly on claude.ai (claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877), lending the lure the legitimate domain's trust. The artifact redirected through claude.ai.download-app[.]us to downloading-api.it[.]com/html/claude/win, which served a trojanized ClaudeDesktop.exe.

Stage 1 (ClaudeDesktop.exe / DockerDesktop.exe) is a repackaged, VMProtect-packed copy of the legitimate JetBrains Chromium Embedded Framework helper (jcef_helper.exe) that sideloads a malicious libcef.dll. This stage resolves further instructions from an Ethereum BNB Smart Chain contract (0xc1907d7be91f95903ad66d775c397302e7dd9228) and downloads a secondary payload, cache.dat.

Stage 2 drops sslconf.exe (a repackaged IBM SPSS binary) to %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe, masquerading as a Microsoft Edge update artifact, alongside a maliciously modified tempdir.dll it sideloads. This stage performs extensive anti-analysis: DXGI GPU adapter enumeration to detect QEMU (0x1234) and VMware (0x15AD) virtual GPU signatures, VRAM threshold checks (<1GB triggers evasion), and DirectX compute-shader timing checks to detect sandboxes/emulation.

Stage 3 decrypts an encrypted payload (appcfg.dat) using a custom AES-256-CTR variant with a modified MixColumns Row 3 transform, with the decryption routine executed as an SM5 DirectX shader on the GPU itself to frustrate static/dynamic analysis. Huntress used Claude Opus 4.8 to assist in reconstructing the shader's cryptographic logic and recovering S-boxes from the compiled DXBC bytecode.

Stage 4 is the final SectopRAT (ArechClient2) .NET payload — a heavily obfuscated info-stealer/RAT active since 2019 that harvests browser logins, cookies, autofill data, credit card numbers, Chromium master keys, FTP credentials, and Discord/Telegram/Steam/VPN client credentials, and provides HVNC (Hidden VNC) for interactive, invisible remote-hands-on access to the victim host. Its C2 channel resolves through a second BNB Smart Chain contract (0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228) using the EtherHiding technique, which stores C2 addressing data inside blockchain transactions so the operator can rotate infrastructure by broadcasting a new transaction rather than standing up a new server, resisting conventional domain/IP takedown.

Persistence is maintained via a scheduled task tied to DockerDesktop.exe for periodic reinfection and via the disguised sslconf.exe under the EdgeUpdate path. Huntress could not attribute the campaign to a known threat cluster but linked the domain-registration email to at least 10 other malicious domains registered since December 2025, one of which (polse[.]us) previously distributed the StealC stealer and was seized by Microsoft/Europol during Operation Endgame. The same libcef.dll DLL-sideloading technique was reportedly used in an April 2026 malicious Docker Hub campaign by what may be the same operator. SectopRAT has separately been observed via CastleLoader campaigns and ClickFix-style fake-CAPTCHA lures, indicating it is actively distributed through multiple malvertising/social-engineering channels in parallel with this campaign.

## MITRE ATT&CK

- T1593 Search Open Websites/Domains
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1053 Scheduled Task/Job
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1036 Masquerading
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SectopRAT/ArechClient2 — EtherHiding Blockchain C2 Resolution + Known C2 Infrastructure + Credential/Cookie Theft (C2 / Lateral Movement)** (`TL-2026-1662-SPL-003`)

Detects the SectopRAT C2 channel: outbound blockchain-RPC-shaped connections (ports 443/8545) from a non-wallet, non-browser process toward BNB Smart Chain infrastructure used for EtherHiding C2 resolution, connections to the disclosed C2 domains/IPs (claude.ai.download-app[.]us backup infra, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, 2.24.131.246, and historical IPs 107.189.24.67/104.194.133.210/45.59.122.82), and subsequent local access to browser credential/cookie stores consistent with SectopRAT's info-stealer collection routine. Matters because EtherHiding resists conventional domain/IP takedown, so behavioral + known-infra detection is the durable control.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1102.002, T1568, T1041, T1555.003, T1539
- **Data sources:** proxy, firewall, sysmon
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR index=firewall sourcetype IN ("proxy:traffic","pan:traffic","stream:tcp")
(dest_ip IN ("2.24.131.246","107.189.24.67","104.194.133.210","45.59.122.82") OR dest_domain IN ("5ca8758c-02d0-4a72-89c8-d468b66dda41.com","claude.ai.download-app.us","downloading-api.it.com"))
| eval detection_category="known_c2_infra"
| append
    [ search index=proxy sourcetype="proxy:traffic" dest_port IN (443,8545)
      NOT (process_name="*MetaMask*" OR process_name="*wallet*" OR process_name="*chrome*" OR process_name="*firefox*" OR process_name="*msedge*")
      | eval detection_category="etherhiding_rpc_pattern" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11
      TargetFilename="*\\Login Data" OR TargetFilename="*\\Cookies" OR TargetFilename="*\\Web Data"
      NOT Image IN ("*\\chrome.exe","*\\msedge.exe","*\\firefox.exe")
      | eval detection_category="browser_credential_access" ]
| table _time host src_ip dest_ip dest_domain dest_port process_name Image TargetFilename detection_category
| sort -_time
```

### Microsoft KQL

```kql
let knownC2Ips = dynamic(["2.24.131.246", "107.189.24.67", "104.194.133.210", "45.59.122.82"]);
let knownC2Domains = dynamic(["5ca8758c-02d0-4a72-89c8-d468b66dda41.com", "claude.ai.download-app.us", "downloading-api.it.com"]);
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in (knownC2Ips) or RemoteUrl has_any (knownC2Domains)
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, Category = "known_c2_infra"
| union (
    DeviceNetworkEvents
    | where Timestamp > ago(24h)
    | where RemotePort in (443, 8545)
    | where InitiatingProcessFileName !has_any ("MetaMask", "wallet", "chrome.exe", "msedge.exe", "firefox.exe")
    | project Timestamp, DeviceName, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessFileName, Category = "etherhiding_rpc_pattern"
)
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where FileName in~ ("Login Data", "Cookies", "Web Data")
    | where InitiatingProcessFileName !in~ ("chrome.exe", "msedge.exe", "firefox.exe")
    | project Timestamp, DeviceName, RemoteIP = "", RemoteUrl = FolderPath, RemotePort = int(null), InitiatingProcessFileName, Category = "browser_credential_access"
)
| order by Timestamp desc
```

### Sigma

```yaml
title: SectopRAT EtherHiding C2 Resolution + Known C2 Infrastructure Contact
id: 9d2b5e4f-1a6c-4f8b-b230-fakeagent0003
status: experimental
description: Detects outbound connections to disclosed FakeAgent/SectopRAT C2 infrastructure and blockchain-RPC-shaped requests from non-wallet processes consistent with the EtherHiding C2-resolution technique.
references:
    - https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html
    - https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-07-23
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1102.002
    - attack.t1568
    - attack.exfiltration
    - attack.t1041
    - attack.credential-access
    - attack.t1555.003
    - attack.t1539
    - attack.tool.sectoprat
logsource:
    category: network_connection
    product: windows
detection:
    selection_known_infra:
        DestinationIp:
            - '2.24.131.246'
            - '107.189.24.67'
            - '104.194.133.210'
            - '45.59.122.82'
    selection_rpc_pattern:
        DestinationPort:
            - 443
            - 8545
    filter_known_wallets:
        Image|contains:
            - 'MetaMask'
            - 'wallet'
            - 'chrome.exe'
            - 'msedge.exe'
            - 'firefox.exe'
    condition: selection_known_infra or (selection_rpc_pattern and not filter_known_wallets)
falsepositives:
    - Legitimate cryptocurrency wallet or dApp software performing genuine JSON-RPC calls to blockchain nodes on port 8545
level: medium
```

**Known false positives:**

- Legitimate cryptocurrency wallet, dApp, or blockchain node-operator software making genuine JSON-RPC calls over port 8545/443; browsers legitimately reading their own Login Data/Cookies/Web Data files

**Tuning notes:** Maintain the known-C2 IP/domain list against Huntress/BleepingComputer IOC updates as EtherHiding lets the operator rotate infrastructure without a new domain; narrow the RPC-port heuristic with a process-reputation/EDR-known-good allow-list to reduce noise from legitimate wallet software before enabling it in blocking mode.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- FakeAgent — Counterfeit Claude/Docker Desktop Download from Non-Canonical Domain + Unsigned CEF DLL Load (Exploitation) (locked: unlock with TL Creds)
- FakeAgent — [indicator] EdgeUpdate Masquerade + [indicator] Side-Load + DockerDesktop Scheduled Task (Post-Exploitation) (locked: unlock with TL Creds)
- SectopRAT/ArechClient2 — EtherHiding Blockchain C2 + Known Infrastructure + Credential Store Access (C2 / Lateral Movement) (locked: unlock with TL Creds)
- Sigma — Unsigned [indicator] Side-Loaded by Trusted-Named Process (FakeAgent Exploitation Stage) (locked: unlock with TL Creds)
- Sigma — Dropper Masquerading Under EdgeUpdate AppData Path + DockerDesktop Scheduled Task (Post-Exploitation) (locked: unlock with TL Creds)
- Sigma — Blockchain-RPC-Shaped Outbound Connection from Non-Wallet Process (EtherHiding C2 Pattern) (locked: unlock with TL Creds)
- FakeAgent — Counterfeit ClaudeDesktop/DockerDesktop Installer Download + [indicator] Side-Load (Exploitation) (locked: unlock with TL Creds)
- FakeAgent — [indicator]/[indicator] EdgeUpdate Masquerade + Anti-VM GPU Enumeration + Scheduled Task Persistence (Post-Exploitation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 27)

Defanged, TLP:CLEAR.

- IP address: `2.24.131[.]246`
- Domain: `claude[.]ai[.]download-app[.]us`
- URL: `hxxps://claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877`

Full set of 27 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations](https://www.itsecurityguru.org/2026/07/23/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations/)
- [Bing Ads Exploited by Hackers to Spread SecTopRAT Through NordVPN Mimic](https://gbhackers.com/bing-ads-exploited/)
- [Bing ad for NordVPN leads to SecTopRAT](https://www.threatdown.com/blog/bing-ad-for-nordvpn-leads-to-sectoprat/)
- [Smart Contracts for Command and Control: How ClearFake Hid in Plain Sight on BSC Testnet](https://www.trendmicro.com/en_us/research/26/e/smart-contracts-for-command-and-control.html)
- [Fake CAPTCHAs, Smart Contracts, Real Risk: Unpacking a ClickFix Campaign Delivering SectopRAT](https://blog.vega.io/posts/clickfix_sectoprat_campaign/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1662