Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT (TL-2026-2197), also tracked as FakeAgent, is a high-severity malware campaign, first published 2026-08-29 and last reviewed 2026-09-11. It has no confirmed attribution, affects Anthropic Claude.ai (public Artifacts) / Claude Desktop /, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 41 indicators of compromise.
Key facts for TL-2026-2197
- Threat ID
- TL-2026-2197
- Also known as
- FakeAgent, AI Attack Surface, AI-Poisoning, LLMShare
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-29
- Last reviewed
- 2026-09-11
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, technology, financial services
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-09-11 · revalidated 1× · latest source
Malware and tooling in Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
Malware and tooling: AMOS, GROK, MacSync Stealer, SectopRAT, EtherHiding
Huntress documents three distinct, ongoing campaigns that abuse the trusted domains of Claude.ai, ChatGPT, and Grok to deliver malware: a 'FakeAgent' malvertising campaign that hosted a fake Claude Desktop installer on claude.ai and hit 29 organizations with the SectopRAT .NET RAT; abuse of claude.ai/share links via sponsored Google results to run a six-stage MacSync stealer/RAT disguised as an Apple Support install guide; and SEO-poisoned, publicly shared ChatGPT/Grok conversations (plus a related fake OpenAI Codex page) that use ClickFix-style Terminal commands to deliver the Atomic macOS Stealer (AMOS).
How Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT works
This is a technique-driven campaign cluster, not a single vulnerability: threat actors are weaponizing the fact that claude.ai, chatgpt.com, and grok.com are trusted, certificate-valid, un-blockable domains. Because the malicious content lives on the AI vendor's own domain (a public Claude Artifact, a claude.ai/share conversation, or a shared ChatGPT/Grok conversation), victims never see a lookalike domain or certificate warning, which defeats the usual visual heuristics defenders and users rely on.
Three sub-campaigns, all reported by Huntress between July and August 2026, share this technique: (1) FakeAgent — a Bing-sponsored ad for 'Claude Desktop app' led to a public Claude Artifact impersonating the Claude Desktop/Cowork download page; the download button chained through claude.ai.download-app[.]us and downloading-api[.]it[.]com to deliver a renamed JetBrains helper binary that DLL-sideloaded a VMProtect-packed loader (libcef.dll) and ultimately an obfuscated SectopRAT (ArechClient2) .NET RAT/stealer. The operator used Ethereum blockchain transactions ('EtherHiding') for takedown-resistant C2 rotation and GPU/DXGI-based anti-VM checks plus DirectX-shader-based payload decryption. The artifact received 7,100 views and impacted 29 organizations before Anthropic removed it. (2) MacSync — a victim searching Google for how to install Claude on a Mac clicked a sponsored result that led to a claude.ai/share conversation spoofed to look like an Apple Support install guide, instructing the victim to paste a curl command into Terminal. This kicked off a six-stage kill chain: a polymorphic zsh loader, an in-memory bridge stage, a ~46KB server-side AppleScript stealer that social-engineers Full Disk Access and harvests browser Safe Storage keys, keychain secrets, SSH/cloud credentials (~/.ssh, ~/.aws, ~/.kube) and the full Telegram Desktop tdata/ session, a persistent C++ Mach-O RAT installed as a LaunchAgent masquerading as a legitimate updater, a separately signed helper that abuses the macOS Screen Recording TCC permission, and a set of trojanized Ledger/Trezor wallet-companion apps that phish BIP39 seed phrases through fake recovery-error UI. CIS/MS-ISAC subsequently reported the same MacSync family actively targeting US SLTT government macOS users, sharing over 1,000 related IOCs. (3) AI-Poisoning/AMOS — attackers craft a ChatGPT or Grok conversation that ends in a plausible 'fix' for common macOS troubleshooting queries (e.g. 'clear disk space on macOS'), share it to get a public URL on the AI vendor's own domain, and SEO-poison that URL to the top of Google results. The Terminal command silently validates the victim's password via `dscl -authonly`, escalates privileges through `sudo -S` with the password piped via stdin, drops a hidden Mach-O payload, trojanizes any installed Ledger/Trezor apps, and persists via a LaunchDaemon-driven watchdog that relaunches the payload under the active GUI session. Cato Networks separately reported a closely related fake OpenAI Codex 'download' hosted on Google Sites using the same ClickFix pattern (Terminal command, `xattr -c`, execution from /tmp/helper) to deliver an AMOS variant. All three sub-campaigns are ongoing as of the August 27, 2026 Huntress report and are financially motivated, with a heavy emphasis on cryptocurrency wallet and browser-credential theft.
MITRE ATT&CK techniques used in TL-2026-2197
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1543.001 Create or Modify System Process: Launch Agent; T1543.004 Create or Modify System Process: Launch Daemon; T1574.002 Hijack Execution Flow: DLL Side-Loading
Execution
T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Discovery
T1082 System Information Discovery
Command and Control
T1102.002 Web Service: Bidirectional Communication
Initial Access
T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link
Credential Access
T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt
Resource Development
T1583.008 Acquire Infrastructure: Malvertising
Impact
Affected products and versions in Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- Anthropic — Claude.ai (public Artifacts) / Claude Desktop / claude.ai/share
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - OpenAI — ChatGPT shared-conversation links / fake OpenAI Codex download page
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - xAI — Grok shared-conversation links
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - Apple — macOS (Terminal/osascript/TCC, targeted by MacSync and AMOS)
Vulnerable versions: All current macOS releases via social engineering, not a macOS vulnerability
Fixed in: N/A - Microsoft — Windows (targeted by SectopRAT/FakeAgent)
Vulnerable versions: All current Windows releases via social engineering, not a Windows vulnerability
Fixed in: N/A
Remediation for Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
Immediate actions
- Block identified C2/delivery domains and IPs at DNS and perimeter firewall (agenticsora[.]com, malwareaudit[.]com, downloading-api[.]it[.]com, claude.ai.download-app[.]us, putuartana[.]com, wbehub[.]org, sanchang[.]org, sdhomeinspectors[.]com, southcarolinacounselor[.]com, 2.24.131[.]246, 85.206.161[.]241, 45.94.47[.]205, 45.94.47[.]186)
- Hunt endpoints for the published file hashes and for DLL-sideloading artifacts named libcef.dll/tempdir.dll/sslconf.exe alongside a ClaudeDesktop.exe download
- On macOS, hunt for LaunchAgents named com.apple.<8hex>.hcpi.plist or similar updater-impersonating labels, and for hidden dot-files under ~/.local and /tmp (.mpwd, .pass, .kpwd, .helper, .agent)
- Report and request takedown of any malicious Claude Artifact or shared ChatGPT/Grok conversation URL directly to Anthropic, OpenAI, or xAI
Workarounds
- Deploy ad-blocking / disable sponsored search result rendering on managed browsers to reduce exposure to malvertised AI-platform links
- Train users never to paste Terminal, PowerShell, or Run-dialog commands copied from a web page or AI chat conversation, even when the page is hosted on a trusted AI vendor domain
- Treat any *.ai/share, chatgpt.com, or grok.com shared-conversation link surfaced via a paid/sponsored search result as untrusted content
Longer-term hardening
- Deploy EDR with behavioral detection for DLL sideloading, osascript/zsh ClickFix execution chains, TCC/Full Disk Access prompt abuse, and silent `dscl -authonly` + `sudo -S` credential validation patterns
- Restrict or log clipboard-to-Terminal and clipboard-to-PowerShell execution
- Enforce application allow-listing for downloaded installers on both Windows and macOS endpoints
Timeline of Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- Earliest identified Ethereum BSC transaction used for SectopRAT/FakeAgent 'EtherHiding' C2 rotation.
- Huntress and Kaspersky report the ChatGPT/Grok shared-conversation AMOS stealer campaign has been active since December, ahead of wider August 2026 disclosure.
- Huntress SOC triages the first alert for an AMOS infection delivered via a ClickFix-style fix embedded in a shared ChatGPT/Grok AI conversation.
- Kaspersky and Huntress publicly disclose the AMOS/ChatGPT-Grok SEO-poisoning campaign, covered the same day by BleepingComputer and Dark Reading.
- MacSync wallet seed-phrase exfiltration domains sdhomeinspectors[.]com and southcarolinacounselor[.]com registered via Unstoppable Domains.
- A related fake-installer campaign distributed via Docker Hub, using the same libcef.dll DLL side-loading technique and attributed to the same operator, is reported.
- claude.ai.download-app[.]us redirect domain registered for the FakeAgent/SectopRAT campaign.
- MacSync's Mach-O RAT binary compiled with statically linked OpenSSL 3.6.2 (build timestamp recovered during reverse engineering).
- A Huntress customer encounters the MacSync malvertising campaign; the affected device is shut down before full payload execution, allowing recovery of malware samples directly from attacker infrastructure.
- FakeAgent malvertising campaign begins distributing via Bing-sponsored 'Claude Desktop app' search ads.
- Huntress SOC detects the malicious Claude Artifact, reports it to Anthropic, and it is removed after 7,100 views across 29 impacted organizations.
- Huntress investigates a MacSync intrusion originating from a victim's Google search for Claude-on-Mac install instructions leading to a spoofed claude.ai/share 'Apple Support' guide.
- Huntress publishes a full reverse-engineering breakdown of the six-stage MacSync stealer/RAT kill chain and its IOCs.
- CIS/MS-ISAC publishes an advisory on the MacSync stealer campaign actively targeting U.S. SLTT government macOS users, sharing over 1,000 related IOCs.
- Cato Networks discloses a related fake OpenAI Codex ClickFix campaign hosted on Google Sites that delivers an AMOS stealer variant.
- Huntress publishes 'The AI Attack Surface,' consolidating the FakeAgent, MacSync, and AMOS/AI-poisoning campaigns into a single trend report.
- BleepingComputer publishes a consolidated report tying together the FakeAgent, MacSync, and AMOS/ChatGPT-Grok campaigns as a single emerging TTP class, adding the EtherHiding smart-contract addresses, the Claude Artifact URL, and the Docker Hub / Operation Endgame (polse.us) operator link.
Update history for TL-2026-2197
- 2026-09-11 — Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) as Malware Delivery Surface — FakeAgent/SectopRAT, MacSync Stealer, and AMOS ClickFix Campaigns: What changed No severity/exploitability/status escalation — all fields remain HIGH/ACTIVE/ACTIVE/LOW attribution, consistent with the existing record. The update is additive: new infrastructure, samples, and MITRE sub-technique granularity
Sources cited for Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Fake Claude app promoted by Bing ads pushes SectopRAT malware
- MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
- Reverse Engineering the Six Stages of MacSync Stealer and RAT
- AI-Poisoning & AMOS Stealer: The Biggest Mac Threat
- The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature
- MacSync Stealer Campaign Impacting U.S. SLTT macOS Users
- When Trust Becomes the Payload in a Fake Codex ClickFix Campaign
- Crooks push Mac malware through fake OpenAI Codex ads
- MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware
- SectopRAT (Malware Family)
More in malware
- Multi-Stage Cobalt Strike Loader Deploys Stageless Beacon via Anti-Sandbox .NET Chain
- Access-Code-Gated Phishing Chain Delivers Vidar Infostealer via DocuSign Impersonation
- ScarfaceStealer: Electron-Delivered Infostealer with Sandbox-Scoring Evasion and Smart-Contract C2
- Gigabud Android Banking Trojan Clones Banking Apps via Hidden Work Profile (Vwork/GoldFactory)
- LegionLoader Malware Distributed via Fake Cloudflare CAPTCHA Using the ClickFix Technique
Detection coverage for TL-2026-2197
As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2197 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.