# Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware

> Huntress documents three distinct, ongoing campaigns that abuse the trusted domains of Claude.ai, ChatGPT, and Grok to deliver malware: a 'FakeAgent' malvertising campaign that hosted a fake Claude Desktop installer on claude.ai and hit 29 organizations with the SectopRAT .NET RAT; abuse of claude.ai/share links via sponsored Google results to run a six-stage MacSync stealer/RAT disguised as an Apple Support install guide; and SEO-poisoned, publicly shared ChatGPT/Grok conversations (plus a related fake OpenAI Codex page) that use ClickFix-style Terminal commands to deliver the Atomic macOS Stealer (AMOS).

- **Published:** 2026-08-29T00:00:00Z
- **Last reviewed:** 2026-09-11T21:35:09.760Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2197
- **ID:** TL-2026-2197
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 41 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This is a technique-driven campaign cluster, not a single vulnerability: threat actors are weaponizing the fact that claude.ai, chatgpt.com, and grok.com are trusted, certificate-valid, un-blockable domains. Because the malicious content lives on the AI vendor's own domain (a public Claude Artifact, a claude.ai/share conversation, or a shared ChatGPT/Grok conversation), victims never see a lookalike domain or certificate warning, which defeats the usual visual heuristics defenders and users rely on.

Three sub-campaigns, all reported by Huntress between July and August 2026, share this technique: (1) FakeAgent — a Bing-sponsored ad for 'Claude Desktop app' led to a public Claude Artifact impersonating the Claude Desktop/Cowork download page; the download button chained through claude.ai.download-app[.]us and downloading-api[.]it[.]com to deliver a renamed JetBrains helper binary that DLL-sideloaded a VMProtect-packed loader (libcef.dll) and ultimately an obfuscated SectopRAT (ArechClient2) .NET RAT/stealer. The operator used Ethereum blockchain transactions ('EtherHiding') for takedown-resistant C2 rotation and GPU/DXGI-based anti-VM checks plus DirectX-shader-based payload decryption. The artifact received 7,100 views and impacted 29 organizations before Anthropic removed it. (2) MacSync — a victim searching Google for how to install Claude on a Mac clicked a sponsored result that led to a claude.ai/share conversation spoofed to look like an Apple Support install guide, instructing the victim to paste a curl command into Terminal. This kicked off a six-stage kill chain: a polymorphic zsh loader, an in-memory bridge stage, a ~46KB server-side AppleScript stealer that social-engineers Full Disk Access and harvests browser Safe Storage keys, keychain secrets, SSH/cloud credentials (~/.ssh, ~/.aws, ~/.kube) and the full Telegram Desktop tdata/ session, a persistent C++ Mach-O RAT installed as a LaunchAgent masquerading as a legitimate updater, a separately signed helper that abuses the macOS Screen Recording TCC permission, and a set of trojanized Ledger/Trezor wallet-companion apps that phish BIP39 seed phrases through fake recovery-error UI. CIS/MS-ISAC subsequently reported the same MacSync family actively targeting US SLTT government macOS users, sharing over 1,000 related IOCs. (3) AI-Poisoning/AMOS — attackers craft a ChatGPT or Grok conversation that ends in a plausible 'fix' for common macOS troubleshooting queries (e.g. 'clear disk space on macOS'), share it to get a public URL on the AI vendor's own domain, and SEO-poison that URL to the top of Google results. The Terminal command silently validates the victim's password via `dscl -authonly`, escalates privileges through `sudo -S` with the password piped via stdin, drops a hidden Mach-O payload, trojanizes any installed Ledger/Trezor apps, and persists via a LaunchDaemon-driven watchdog that relaunches the payload under the active GUI session. Cato Networks separately reported a closely related fake OpenAI Codex 'download' hosted on Google Sites using the same ClickFix pattern (Terminal command, `xattr -c`, execution from /tmp/helper) to deliver an AMOS variant. All three sub-campaigns are ongoing as of the August 27, 2026 Huntress report and are financially motivated, with a heavy emphasis on cryptocurrency wallet and browser-credential theft.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1543.001 Create or Modify System Process: Launch Agent
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1548 Abuse Elevation Control Mechanism
- T1070.004 Indicator Removal: File Deletion
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1113 Screen Capture
- T1657 Financial Theft
- T1583.008 Acquire Infrastructure: Malvertising
- T1189 Drive-by Compromise
- T1204.002 User Execution: Malicious File
- T1204.004 User Execution: Malicious Copy and Paste
- T1574.002 Hijack Execution Flow: DLL Side-Loading
- T1543.004 Create or Modify System Process: Launch Daemon
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1548.004 Abuse Elevation Control Mechanism: Elevated Execution with Prompt
- T1027.002 Obfuscated Files or Information: Software Packing
- T1140 Deobfuscate/Decode Files or Information
- T1497.001 Virtualization/Sandbox Evasion: System Checks
- T1102.002 Web Service: Bidirectional Communication
- T1041 Exfiltration Over C2 Channel

## Sources

- [The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms](https://www.huntress.com/blog/ai-attack-surface)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)
- [MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer](https://www.huntress.com/blog/fake-claude-macsync)
- [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [AI-Poisoning & AMOS Stealer: The Biggest Mac Threat](https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust)
- [The AMOS infostealer is piggybacking ChatGPT's chat-sharing feature](https://www.kaspersky.com/blog/share-chatgpt-chat-clickfix-macos-amos-infostealer/54928/)
- [MacSync Stealer Campaign Impacting U.S. SLTT macOS Users](https://www.cisecurity.org/insights/blog/macsync-stealer-campaign-impacting-us-sltt-macos-users)
- [When Trust Becomes the Payload in a Fake Codex ClickFix Campaign](https://www.catonetworks.com/blog/cato-ctrl-when-trust-becomes-payload-in-fake-codex-clickfix-campaign/)
- [Crooks push Mac malware through fake OpenAI Codex ads](https://www.theregister.com/security/2026/08/25/crooks-push-mac-malware-through-fake-openai-codex-ads/5291899)
- [MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware](https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/)
- [SectopRAT (Malware Family)](https://malpedia.caad.fkie.fraunhofer.de/details/win.sectop_rat)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2197