Threat reportMalwareTL-2026-2197
Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT (TL-2026-2197), also tracked as FakeAgent, is a high-severity malware campaign, first published 2026-08-29 and last reviewed 2026-09-11. It has no confirmed attribution, affects Anthropic Claude.ai (public Artifacts) / Claude Desktop /, maps to 30 MITRE ATT&CK techniques (T1005, T1027, T1027.002), and is covered by 9 detection rules and 41 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 30MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 41Indicators of compromise
Key facts for TL-2026-2197
- Threat ID
- TL-2026-2197
- Also known as
- FakeAgent, AI Attack Surface, AI-Poisoning, LLMShare
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- government administration, technology, financial services
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-09-11 · revalidated 1× · latest source
Malware and tooling in Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
Malware and tooling: AMOS, GROK, MacSync Stealer, SectopRAT, EtherHiding
How Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT works
Huntress documents three distinct, ongoing campaigns that abuse the trusted domains of Claude.ai, ChatGPT, and Grok to deliver malware: a 'FakeAgent' malvertising campaign that hosted a fake Claude Desktop installer on claude.ai and hit 29 organizations with the SectopRAT .NET RAT; abuse of claude.ai/share links via sponsored Google results to run a six-stage MacSync stealer/RAT disguised as an Apple Support install guide; and SEO-poisoned, publicly shared ChatGPT/Grok conversations (plus a related fake OpenAI Codex page) that use ClickFix-style Terminal commands to deliver the Atomic macOS Stealer (AMOS).
This is a technique-driven campaign cluster, not a single vulnerability: threat actors are weaponizing the fact that claude.ai, chatgpt.com, and grok.com are trusted, certificate-valid, un-blockable domains. Because the malicious content lives on the AI vendor's own domain (a public Claude Artifact, a claude.ai/share conversation, or a shared ChatGPT/Grok conversation), victims never see a lookalike domain or certificate warning, which defeats the usual visual heuristics defenders and users rely on.
Three sub-campaigns, all reported by Huntress between July and August 2026, share this technique: (1) FakeAgent — a Bing-sponsored ad for 'Claude Desktop app' led to a public Claude Artifact impersonating the Claude Desktop/Cowork download page; the download button chained through claude.ai.download-app[.]us and downloading-api[.]it[.]com to deliver a renamed JetBrains helper binary that DLL-sideloaded a VMProtect-packed loader (libcef.dll) and ultimately an obfuscated SectopRAT (ArechClient2) .NET RAT/stealer. The operator used Ethereum blockchain transactions ('EtherHiding') for takedown-resistant C2 rotation and GPU/DXGI-based anti-VM checks plus DirectX-shader-based payload decryption. The artifact received 7,100 views and impacted 29 organizations before Anthropic removed it. (2) MacSync — a victim searching Google for how to install Claude on a Mac clicked a sponsored result that led to a claude.ai/share conversation spoofed to look like an Apple Support install guide, instructing the victim to paste a curl command into Terminal. This kicked off a six-stage kill chain: a polymorphic zsh loader, an in-memory bridge stage, a ~46KB server-side AppleScript stealer that social-engineers Full Disk Access and harvests browser Safe Storage keys, keychain secrets, SSH/cloud credentials (~/.ssh, ~/.aws, ~/.kube) and the full Telegram Desktop tdata/ session, a persistent C++ Mach-O RAT installed as a LaunchAgent masquerading as a legitimate updater, a separately signed helper that abuses the macOS Screen Recording TCC permission, and a set of trojanized Ledger/Trezor wallet-companion apps that phish BIP39 seed phrases through fake recovery-error UI. CIS/MS-ISAC subsequently reported the same MacSync family actively targeting US SLTT government macOS users, sharing over 1,000 related IOCs. (3) AI-Poisoning/AMOS — attackers craft a ChatGPT or Grok conversation that ends in a plausible 'fix' for common macOS troubleshooting queries (e.g. 'clear disk space on macOS'), share it to get a public URL on the AI vendor's own domain, and SEO-poison that URL to the top of Google results. The Terminal command silently validates the victim's password via `dscl -authonly`, escalates privileges through `sudo -S` with the password piped via stdin, drops a hidden Mach-O payload, trojanizes any installed Ledger/Trezor apps, and persists via a LaunchDaemon-driven watchdog that relaunches the payload under the active GUI session. Cato Networks separately reported a closely related fake OpenAI Codex 'download' hosted on Google Sites using the same ClickFix pattern (Terminal command, `xattr -c`, execution from /tmp/helper) to deliver an AMOS variant. All three sub-campaigns are ongoing as of the August 27, 2026 Huntress report and are financially motivated, with a heavy emphasis on cryptocurrency wallet and browser-credential theft.
MITRE ATT&CK techniques used in TL-2026-2197
Collection
T1005 Data from Local System; T1113 Screen Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.005 Match Legitimate Resource Name or Location; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 Virtualization/Sandbox Evasion: System Checks; T1574.001 DLL
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task; T1543.001 Create or Modify System Process: Launch Agent; T1543.004 Create or Modify System Process: Launch Daemon; T1574.002 Hijack Execution Flow: DLL Side-Loading
Execution
T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File; T1204.004 User Execution: Malicious Copy and Paste
Discovery
T1082 System Information Discovery
Command and Control
T1102.002 Web Service: Bidirectional Communication
Initial Access
T1189 Drive-by Compromise; T1566.002 Phishing: Spearphishing Link
Credential Access
T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
privilege-escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt
Resource Development
T1583.008 Acquire Infrastructure: Malvertising
Impact
Affected products and versions in Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- Anthropic — Claude.ai (public Artifacts) / Claude Desktop / claude.ai/share
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - OpenAI — ChatGPT shared-conversation links / fake OpenAI Codex download page
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - xAI — Grok shared-conversation links
Vulnerable versions: N/A - platform-trust abuse, not a software defect
Fixed in: N/A - Apple — macOS (Terminal/osascript/TCC, targeted by MacSync and AMOS)
Vulnerable versions: All current macOS releases via social engineering, not a macOS vulnerability
Fixed in: N/A - Microsoft — Windows (targeted by SectopRAT/FakeAgent)
Vulnerable versions: All current Windows releases via social engineering, not a Windows vulnerability
Fixed in: N/A
Remediation for Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
Immediate actions
- Block identified C2/delivery domains and IPs at DNS and perimeter firewall (agenticsora[.]com, malwareaudit[.]com, downloading-api[.]it[.]com, claude.ai.download-app[.]us, putuartana[.]com, wbehub[.]org, sanchang[.]org, sdhomeinspectors[.]com, southcarolinacounselor[.]com, 2.24.131[.]246, 85.206.161[.]241, 45.94.47[.]205, 45.94.47[.]186)
- Hunt endpoints for the published file hashes and for DLL-sideloading artifacts named libcef.dll/tempdir.dll/sslconf.exe alongside a ClaudeDesktop.exe download
- On macOS, hunt for LaunchAgents named com.apple.<8hex>.hcpi.plist or similar updater-impersonating labels, and for hidden dot-files under ~/.local and /tmp (.mpwd, .pass, .kpwd, .helper, .agent)
- Report and request takedown of any malicious Claude Artifact or shared ChatGPT/Grok conversation URL directly to Anthropic, OpenAI, or xAI
Workarounds
- Deploy ad-blocking / disable sponsored search result rendering on managed browsers to reduce exposure to malvertised AI-platform links
- Train users never to paste Terminal, PowerShell, or Run-dialog commands copied from a web page or AI chat conversation, even when the page is hosted on a trusted AI vendor domain
- Treat any *.ai/share, chatgpt.com, or grok.com shared-conversation link surfaced via a paid/sponsored search result as untrusted content
Longer-term hardening
- Deploy EDR with behavioral detection for DLL sideloading, osascript/zsh ClickFix execution chains, TCC/Full Disk Access prompt abuse, and silent `dscl -authonly` + `sudo -S` credential validation patterns
- Restrict or log clipboard-to-Terminal and clipboard-to-PowerShell execution
- Enforce application allow-listing for downloaded installers on both Windows and macOS endpoints
Timeline of Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- Earliest identified Ethereum BSC transaction used for SectopRAT/FakeAgent 'EtherHiding' C2 rotation.
- Huntress and Kaspersky report the ChatGPT/Grok shared-conversation AMOS stealer campaign has been active since December, ahead of wider August 2026 disclosure.
- Huntress SOC triages the first alert for an AMOS infection delivered via a ClickFix-style fix embedded in a shared ChatGPT/Grok AI conversation.
- Kaspersky and Huntress publicly disclose the AMOS/ChatGPT-Grok SEO-poisoning campaign, covered the same day by BleepingComputer and Dark Reading.
- MacSync wallet seed-phrase exfiltration domains sdhomeinspectors[.]com and southcarolinacounselor[.]com registered via Unstoppable Domains.
- A related fake-installer campaign distributed via Docker Hub, using the same libcef.dll DLL side-loading technique and attributed to the same operator, is reported.
- claude.ai.download-app[.]us redirect domain registered for the FakeAgent/SectopRAT campaign.
- MacSync's Mach-O RAT binary compiled with statically linked OpenSSL 3.6.2 (build timestamp recovered during reverse engineering).
- A Huntress customer encounters the MacSync malvertising campaign; the affected device is shut down before full payload execution, allowing recovery of malware samples directly from attacker infrastructure.
- FakeAgent malvertising campaign begins distributing via Bing-sponsored 'Claude Desktop app' search ads.
- Huntress SOC detects the malicious Claude Artifact, reports it to Anthropic, and it is removed after 7,100 views across 29 impacted organizations.
- Huntress investigates a MacSync intrusion originating from a victim's Google search for Claude-on-Mac install instructions leading to a spoofed claude.ai/share 'Apple Support' guide.
- Huntress publishes a full reverse-engineering breakdown of the six-stage MacSync stealer/RAT kill chain and its IOCs.
- CIS/MS-ISAC publishes an advisory on the MacSync stealer campaign actively targeting U.S. SLTT government macOS users, sharing over 1,000 related IOCs.
- Cato Networks discloses a related fake OpenAI Codex ClickFix campaign hosted on Google Sites that delivers an AMOS stealer variant.
- Huntress publishes 'The AI Attack Surface,' consolidating the FakeAgent, MacSync, and AMOS/AI-poisoning campaigns into a single trend report.
- BleepingComputer publishes a consolidated report tying together the FakeAgent, MacSync, and AMOS/ChatGPT-Grok campaigns as a single emerging TTP class, adding the EtherHiding smart-contract addresses, the Claude Artifact URL, and the Docker Hub / Operation Endgame (polse.us) operator link.
Update history for TL-2026-2197
- 2026-09-11 — Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) as Malware Delivery Surface — FakeAgent/SectopRAT, MacSync Stealer, and AMOS ClickFix Campaigns: What changed No severity/exploitability/status escalation — all fields remain HIGH/ACTIVE/ACTIVE/LOW attribution, consistent with the existing record. The update is additive: new infrastructure, samples, and MITRE sub-technique granularity
Sources cited for Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT
- The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Fake Claude app promoted by Bing ads pushes SectopRAT malware
- MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
- Reverse Engineering the Six Stages of MacSync Stealer and RAT
- AI-Poisoning & AMOS Stealer: The Biggest Mac Threat
- The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature
- MacSync Stealer Campaign Impacting U.S. SLTT macOS Users
- When Trust Becomes the Payload in a Fake Codex ClickFix Campaign
- Crooks push Mac malware through fake OpenAI Codex ads
- MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware
- SectopRAT (Malware Family)
Detection coverage for TL-2026-2197
As of 2026-09-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2197 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.