Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
Trusted AI Platforms Weaponized as Malware Distribution (TL-2026-2604), also tracked as FakeAgent, is a high-severity malware campaign, first published 2026-09-21. It has no confirmed attribution, affects Anthropic Claude Artifacts / claude.ai share links, maps to 19 MITRE ATT&CK techniques (T1036.005, T1053.005, T1059.002), and is covered by 9 detection rules and 30 indicators of compromise.
Key facts for TL-2026-2604
- Threat ID
- TL-2026-2604
- Also known as
- FakeAgent
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-09-21
- Last reviewed
- 2026-09-21
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- enterprise, finance, consumer individual users
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in Trusted AI Platforms Weaponized as Malware Distribution
Malware and tooling: AMOS, SectopRAT, 0xc1907d7be91f95903ad66d775c397302e7dd9228, 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228
Across a nine-month span (December 2025-September 2026), criminal actors abused the public-sharing features of Claude Artifacts, claude.ai/share, ChatGPT, and Grok to host convincing malware lures directly on trusted AI-vendor domains, delivering the SectopRAT .NET RAT (29+ organizations, July 2026), the newly documented MacSync macOS stealer/RAT, and the AMOS macOS stealer (December 2025) with no spoofed domains or certificate warnings to warn victims.
How Trusted AI Platforms Weaponized as Malware Distribution works
Huntress documented three distinct but pattern-linked campaigns that exploit the same structural weakness: AI platforms let anyone publish content that is served from the platform's own trusted, certificate-valid domain, and that content can be surfaced via paid search ads or SEO. In the FakeAgent campaign (21-22 July 2026), attackers built a public Claude Artifact at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877 that pixel-perfectly imitated the Claude Desktop download page. Bing sponsored ads for "Claude Desktop app" pointed victims to the genuine claude.ai domain, where the artifact redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a malicious ClaudeDesktop.exe. That file was actually a legitimate, signed JetBrains Chromium Embedded Framework (jcef_helper.exe) binary abused for DLL side-loading against a tampered, VMProtect-packed libcef.dll, which dropped a second sideloading pair (a renamed IBM SPSS binary plus tempdir.dll) that performed GPU-based anti-VM checks (DXGI adapter IDs, VRAM thresholds, compute-shader timing) and used a DirectX shader to decrypt an embedded SectopRAT .NET payload. SectopRAT's C2 configuration was stored on the BNB Smart Chain (EtherHiding) across two contracts, yielding a chain of historical C2 IPs from May 2025 through an active address in June 2026. The malicious artifact drew 7,100 views before Anthropic removed it; at least 29 organizations were compromised in the 48-hour window. WHOIS/Validin analysis tied the redirect infrastructure to a single registrant email linked to ten domains dating back to December 2025, one of which (polse[.]us) was separately seized by Microsoft under Operation Endgame for hosting StealC infrastructure, and the libcef.dll side-loading technique was linked to an April 2026 malicious Docker Hub campaign. In the second campaign, a claude.ai/share link styled as an official Apple Support installation guide instructed victims to paste a single curl command into Terminal. That command kicked off a previously undocumented six-stage macOS malware family Huntress named MacSync: a thin base64/gzip zsh loader; a daemon function that fetches and runs an AppleScript stealer server-side (keeping the logic off-disk, gated behind a shared API key); the AppleScript itself, which validates the account password via dscl, harvests Keychain Safe Storage keys for 13+ Chromium browsers plus Firefox, Telegram session data, SSH/AWS/Kubernetes keys, and ~21 desktop wallet apps into /tmp/osalogging.zip; a universal Mach-O RAT installed as a LaunchAgent that beacons over TLS to 85.206.161[.]241:8443 with AES-256-CBC-encrypted JSON; a separately signed helper that requests Screen Recording TCC permission and shells out to screencapture; and a set of trojanized Electron wallet apps (Ledger Wallet, Ledger Live, Trezor Suite) that phish recovery-phrase seed words to attacker-registered drop domains. Because the lure sat on Anthropic's own certificate-valid infrastructure, none of the usual phishing indicators applied; the only tell was a small unverified-content disclaimer. In the third campaign (incident observed 5 December 2025), a Google search for "Clear disk space on macOS" surfaced SEO-poisoned, publicly shared ChatGPT and Grok conversations posing as legitimate troubleshooting advice. The conversations ended in ClickFix-style Terminal instructions; because macOS Gatekeeper does not inspect shell scripts or one-liners, the base64-encoded command executed without any prompt and pulled the AMOS macOS stealer, which validates the password via dscl -authonly, pipes it to sudo -S for silent root execution, installs a LaunchDaemon (com.finder.helper.plist) that relaunches a Mach-O helper every second, stages stolen browser, Keychain, and cryptocurrency-wallet data to /tmp/out.zip, and overwrites legitimate Ledger Wallet installations with a trojanized, ad-hoc-signed copy. All three campaigns share a common criminal playbook: register short-lived, thematically-named infrastructure; stage the lure entirely on a trusted AI vendor's own domain to defeat visual phishing cues; drive traffic via paid search placement or SEO; and monetize through commodity credential/financial-data theft rather than targeted espionage.
MITRE ATT&CK techniques used in TL-2026-2604
Defense Evasion
T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL
Persistence
T1053.005 Scheduled Task; T1543.001 Launch Agent
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.002 Bidirectional Communication
Credential Access
T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
defense-impairment
Collection
Resource Development
T1583.001 Domains; T1608.001 Upload Malware
Impact
Affected products and versions in Trusted AI Platforms Weaponized as Malware Distribution
- Anthropic — Claude Artifacts / claude.ai share links
Vulnerable versions: public artifact/share publishing feature, all versions as of 2026 - OpenAI — ChatGPT shared conversations
Vulnerable versions: public conversation-sharing feature, as of December 2025 - xAI — Grok shared conversations
Vulnerable versions: public conversation-sharing feature, as of December 2025 - Microsoft — Windows (SectopRAT/FakeAgent target)
Vulnerable versions: all supported Windows versions - Apple — macOS (MacSync and AMOS target)
Vulnerable versions: all supported macOS versions
Remediation for Trusted AI Platforms Weaponized as Malware Distribution
Immediate actions
- Block/monitor egress to claude.ai.download-app[.]us, downloading-api.it[.]com, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, agenticsora[.]com, malwareaudit[.]com, putuartana[.]com, wbehub[.]org, sanchang[.]org, main.sdhomeinspectors[.]com, and main.southcarolinacounselor[.]com
- Block/alert on connections to C2 IPs 2.24.131[.]246, 85.206.161[.]241:8443, 103.216.221[.]95, 45.94.47[.]205, and 45.94.47[.]186
- Hunt for the file hashes in this record across EDR telemetry, especially renamed JetBrains/IBM SPSS binaries paired with a co-located libcef.dll or tempdir.dll
- Search for LaunchAgent/LaunchDaemon plists matching com.apple.<8-hex>.hcpi*.plist or com.finder.helper.plist, and Windows scheduled tasks named DockerDesktop.exe
Workarounds
- Only download AI vendor desktop applications from the vendor's official, non-shareable download page, never from a search ad or a shared conversation/artifact link
- Verify digital signatures on downloaded installers before execution
Longer-term hardening
- Enforce application whitelisting to prevent unsigned or side-loaded DLLs from executing alongside signed vendor binaries
- Restrict clipboard-triggered/paste-to-terminal script execution and deploy EDR behavioral detection for curl-piped-to-shell one-liners on both macOS and Windows
- Monitor for newly created scheduled tasks, LaunchAgents/LaunchDaemons, and antivirus/Defender exclusion changes as a generic persistence signal
- Treat troubleshooting or installation commands sourced from AI chat platforms (ChatGPT, Grok, Claude) as untrusted input requiring origin verification before execution
Timeline of Trusted AI Platforms Weaponized as Malware Distribution
- First of ten domains later linked by a shared registrant email (via WHOIS/Validin) to the FakeAgent redirect infrastructure begins appearing.
- Huntress observes an incident where a customer, searching Google for "Clear disk space on macOS", is led to a SEO-poisoned, publicly shared ChatGPT conversation delivering ClickFix-style Terminal commands that install the AMOS stealer.
- Huntress publishes "AI-Poisoning & AMOS Stealer: The Biggest Mac Threat", documenting the SEO-poisoned ChatGPT/Grok shared-conversation delivery chain for AMOS.
- Attackers reuse the identical tampered libcef.dll DLL side-loading technique in a separate malicious Docker Hub campaign, later attributed by Huntress to the same tooling lineage as FakeAgent.
- The redirect domain claude.ai.download-app[.]us is registered.
- Earliest historical SectopRAT C2 IP (107.189.24[.]67) is recorded in BNB Smart Chain (EtherHiding) transaction data tied to the campaign's contracts.
- Microsoft, Europol, and partners execute an Operation Endgame action disrupting StealC and Amadey infostealer infrastructure; the domain polse[.]us, later linked to the FakeAgent registrant email, is among the seized StealC domains.
- FakeAgent campaign begins: a malicious Claude Artifact impersonating the Claude Desktop download page is served via Bing sponsored ads for "Claude Desktop app", redirecting victims through claude.ai.download-app[.]us and downloading-api.it[.]com to a SectopRAT-laced ClaudeDesktop.exe.
- The malicious Claude Artifact (7,100 views) is removed by Anthropic after compromising at least 29 organizations in roughly 48 hours.
- Huntress, BleepingComputer, Help Net Security, and IT Security Guru publish coordinated coverage of the FakeAgent/SectopRAT campaign, including the DLL side-loading chain, EtherHiding C2, and 29-organization impact figure.
- Huntress publishes "Reverse Engineering the Six Stages of MacSync Stealer and RAT", detailing a fake Apple Support install guide hosted on claude.ai/share that delivers a previously undocumented six-stage macOS stealer/RAT.
- Follow-on reporting (including a Ledger-focused writeup) highlights MacSync's targeting of desktop cryptocurrency wallet applications and trojanized Ledger/Trezor installers.
- Huntress publishes "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms", formally tying FakeAgent, MacSync, and the AMOS ChatGPT/Grok campaign together as a nine-month pattern; syndicated by BleepingComputer the same week.
- NSFOCUS publishes a consolidated incident-case report summarizing all three campaigns, triggering this threat record.
Sources cited for Trusted AI Platforms Weaponized as Malware Distribution
- AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
- Reverse Engineering the Six Stages of MacSync Stealer and RAT
- AI-Poisoning & AMOS Stealer: The Biggest Mac Threat
- The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms
- How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
- Fake Claude app promoted by Bing ads pushes SectopRAT malware
- How attackers hosted a fake Claude download page on the claude.ai domain
- FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations
- Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds
- Amadey, StealC malware operations disrupted in Operation Endgame action
- Operation Endgame Takes Down StealC and Amadey Infostealers
More in malware
- Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos
- EtherHiding Malware Abuses Polygon Blockchain to Hide C2 and Steal Banking Credentials
- Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors
- PowerShell Cryptomining Loader Abuses Registry-Resident Scripts, DNS TXT Records, and PNG/WAV Steganography for Stealth C2
- RatHat: AI-Powered Android Banking Trojan Abuses Accessibility Service and ADB to Steal Credentials, PINs, and MFA Codes
Detection coverage for TL-2026-2604
As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2604 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.