Threat reportMalwareTL-2026-2604
Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
Trusted AI Platforms Weaponized as Malware Distribution (TL-2026-2604), also tracked as FakeAgent, is a high-severity malware campaign, first published 2026-09-21. It has no confirmed attribution, affects Anthropic Claude Artifacts / claude.ai share links, maps to 19 MITRE ATT&CK techniques (T1036.005, T1053.005, T1059.002), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 19MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-2604
- Threat ID
- TL-2026-2604
- Also known as
- FakeAgent
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, finance, consumer individual users
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Trusted AI Platforms Weaponized as Malware Distribution
Malware and tooling: AMOS, SectopRAT, 0xc1907d7be91f95903ad66d775c397302e7dd9228, 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228
How Trusted AI Platforms Weaponized as Malware Distribution works
Across a nine-month span (December 2025-September 2026), criminal actors abused the public-sharing features of Claude Artifacts, claude.ai/share, ChatGPT, and Grok to host convincing malware lures directly on trusted AI-vendor domains, delivering the SectopRAT .NET RAT (29+ organizations, July 2026), the newly documented MacSync macOS stealer/RAT, and the AMOS macOS stealer (December 2025) with no spoofed domains or certificate warnings to warn victims.
Huntress documented three distinct but pattern-linked campaigns that exploit the same structural weakness: AI platforms let anyone publish content that is served from the platform's own trusted, certificate-valid domain, and that content can be surfaced via paid search ads or SEO. In the FakeAgent campaign (21-22 July 2026), attackers built a public Claude Artifact at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877 that pixel-perfectly imitated the Claude Desktop download page. Bing sponsored ads for "Claude Desktop app" pointed victims to the genuine claude.ai domain, where the artifact redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a malicious ClaudeDesktop.exe. That file was actually a legitimate, signed JetBrains Chromium Embedded Framework (jcef_helper.exe) binary abused for DLL side-loading against a tampered, VMProtect-packed libcef.dll, which dropped a second sideloading pair (a renamed IBM SPSS binary plus tempdir.dll) that performed GPU-based anti-VM checks (DXGI adapter IDs, VRAM thresholds, compute-shader timing) and used a DirectX shader to decrypt an embedded SectopRAT .NET payload. SectopRAT's C2 configuration was stored on the BNB Smart Chain (EtherHiding) across two contracts, yielding a chain of historical C2 IPs from May 2025 through an active address in June 2026. The malicious artifact drew 7,100 views before Anthropic removed it; at least 29 organizations were compromised in the 48-hour window. WHOIS/Validin analysis tied the redirect infrastructure to a single registrant email linked to ten domains dating back to December 2025, one of which (polse[.]us) was separately seized by Microsoft under Operation Endgame for hosting StealC infrastructure, and the libcef.dll side-loading technique was linked to an April 2026 malicious Docker Hub campaign. In the second campaign, a claude.ai/share link styled as an official Apple Support installation guide instructed victims to paste a single curl command into Terminal. That command kicked off a previously undocumented six-stage macOS malware family Huntress named MacSync: a thin base64/gzip zsh loader; a daemon function that fetches and runs an AppleScript stealer server-side (keeping the logic off-disk, gated behind a shared API key); the AppleScript itself, which validates the account password via dscl, harvests Keychain Safe Storage keys for 13+ Chromium browsers plus Firefox, Telegram session data, SSH/AWS/Kubernetes keys, and ~21 desktop wallet apps into /tmp/osalogging.zip; a universal Mach-O RAT installed as a LaunchAgent that beacons over TLS to 85.206.161[.]241:8443 with AES-256-CBC-encrypted JSON; a separately signed helper that requests Screen Recording TCC permission and shells out to screencapture; and a set of trojanized Electron wallet apps (Ledger Wallet, Ledger Live, Trezor Suite) that phish recovery-phrase seed words to attacker-registered drop domains. Because the lure sat on Anthropic's own certificate-valid infrastructure, none of the usual phishing indicators applied; the only tell was a small unverified-content disclaimer. In the third campaign (incident observed 5 December 2025), a Google search for "Clear disk space on macOS" surfaced SEO-poisoned, publicly shared ChatGPT and Grok conversations posing as legitimate troubleshooting advice. The conversations ended in ClickFix-style Terminal instructions; because macOS Gatekeeper does not inspect shell scripts or one-liners, the base64-encoded command executed without any prompt and pulled the AMOS macOS stealer, which validates the password via dscl -authonly, pipes it to sudo -S for silent root execution, installs a LaunchDaemon (com.finder.helper.plist) that relaunches a Mach-O helper every second, stages stolen browser, Keychain, and cryptocurrency-wallet data to /tmp/out.zip, and overwrites legitimate Ledger Wallet installations with a trojanized, ad-hoc-signed copy. All three campaigns share a common criminal playbook: register short-lived, thematically-named infrastructure; stage the lure entirely on a trusted AI vendor's own domain to defeat visual phishing cues; drive traffic via paid search placement or SEO; and monetize through commodity credential/financial-data theft rather than targeted espionage.
MITRE ATT&CK techniques used in TL-2026-2604
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Credential Access
T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
defense-impairment
Collection
Resource Development
T1583.001 Domains; T1608.001 Upload Malware
Impact
Affected products and versions in Trusted AI Platforms Weaponized as Malware Distribution
- Anthropic — Claude Artifacts / claude.ai share links
Vulnerable versions: public artifact/share publishing feature, all versions as of 2026 - OpenAI — ChatGPT shared conversations
Vulnerable versions: public conversation-sharing feature, as of December 2025 - xAI — Grok shared conversations
Vulnerable versions: public conversation-sharing feature, as of December 2025 - Microsoft — Windows (SectopRAT/FakeAgent target)
Vulnerable versions: all supported Windows versions - Apple — macOS (MacSync and AMOS target)
Vulnerable versions: all supported macOS versions
Remediation for Trusted AI Platforms Weaponized as Malware Distribution
Immediate actions
- Block/monitor egress to claude.ai.download-app[.]us, downloading-api.it[.]com, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, agenticsora[.]com, malwareaudit[.]com, putuartana[.]com, wbehub[.]org, sanchang[.]org, main.sdhomeinspectors[.]com, and main.southcarolinacounselor[.]com
- Block/alert on connections to C2 IPs 2.24.131[.]246, 85.206.161[.]241:8443, 103.216.221[.]95, 45.94.47[.]205, and 45.94.47[.]186
- Hunt for the file hashes in this record across EDR telemetry, especially renamed JetBrains/IBM SPSS binaries paired with a co-located libcef.dll or tempdir.dll
- Search for LaunchAgent/LaunchDaemon plists matching com.apple.<8-hex>.hcpi*.plist or com.finder.helper.plist, and Windows scheduled tasks named DockerDesktop.exe
Workarounds
- Only download AI vendor desktop applications from the vendor's official, non-shareable download page, never from a search ad or a shared conversation/artifact link
- Verify digital signatures on downloaded installers before execution
Longer-term hardening
- Enforce application whitelisting to prevent unsigned or side-loaded DLLs from executing alongside signed vendor binaries
- Restrict clipboard-triggered/paste-to-terminal script execution and deploy EDR behavioral detection for curl-piped-to-shell one-liners on both macOS and Windows
- Monitor for newly created scheduled tasks, LaunchAgents/LaunchDaemons, and antivirus/Defender exclusion changes as a generic persistence signal
- Treat troubleshooting or installation commands sourced from AI chat platforms (ChatGPT, Grok, Claude) as untrusted input requiring origin verification before execution
Timeline of Trusted AI Platforms Weaponized as Malware Distribution
- First of ten domains later linked by a shared registrant email (via WHOIS/Validin) to the FakeAgent redirect infrastructure begins appearing.
- Huntress observes an incident where a customer, searching Google for "Clear disk space on macOS", is led to a SEO-poisoned, publicly shared ChatGPT conversation delivering ClickFix-style Terminal commands that install the AMOS stealer.
- Huntress publishes "AI-Poisoning & AMOS Stealer: The Biggest Mac Threat", documenting the SEO-poisoned ChatGPT/Grok shared-conversation delivery chain for AMOS.
- Attackers reuse the identical tampered libcef.dll DLL side-loading technique in a separate malicious Docker Hub campaign, later attributed by Huntress to the same tooling lineage as FakeAgent.
- The redirect domain claude.ai.download-app[.]us is registered.
- Earliest historical SectopRAT C2 IP (107.189.24[.]67) is recorded in BNB Smart Chain (EtherHiding) transaction data tied to the campaign's contracts.
- Microsoft, Europol, and partners execute an Operation Endgame action disrupting StealC and Amadey infostealer infrastructure; the domain polse[.]us, later linked to the FakeAgent registrant email, is among the seized StealC domains.
- FakeAgent campaign begins: a malicious Claude Artifact impersonating the Claude Desktop download page is served via Bing sponsored ads for "Claude Desktop app", redirecting victims through claude.ai.download-app[.]us and downloading-api.it[.]com to a SectopRAT-laced ClaudeDesktop.exe.
- The malicious Claude Artifact (7,100 views) is removed by Anthropic after compromising at least 29 organizations in roughly 48 hours.
- Huntress, BleepingComputer, Help Net Security, and IT Security Guru publish coordinated coverage of the FakeAgent/SectopRAT campaign, including the DLL side-loading chain, EtherHiding C2, and 29-organization impact figure.
- Huntress publishes "Reverse Engineering the Six Stages of MacSync Stealer and RAT", detailing a fake Apple Support install guide hosted on claude.ai/share that delivers a previously undocumented six-stage macOS stealer/RAT.
- Follow-on reporting (including a Ledger-focused writeup) highlights MacSync's targeting of desktop cryptocurrency wallet applications and trojanized Ledger/Trezor installers.
- Huntress publishes "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms", formally tying FakeAgent, MacSync, and the AMOS ChatGPT/Grok campaign together as a nine-month pattern; syndicated by BleepingComputer the same week.
- NSFOCUS publishes a consolidated incident-case report summarizing all three campaigns, triggering this threat record.
Sources cited for Trusted AI Platforms Weaponized as Malware Distribution
- AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Reverse Engineering the Six Stages of MacSync Stealer and RAT
- AI-Poisoning & AMOS Stealer: The Biggest Mac Threat
- The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
- How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
- Fake Claude app promoted by Bing ads pushes SectopRAT malware
- How attackers hosted a fake Claude download page on the claude.ai domain
- FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations
- Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds
- Amadey, StealC malware operations disrupted in Operation Endgame action
- Operation Endgame Takes Down StealC and Amadey Infostealers
Detection coverage for TL-2026-2604
As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2604 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.