Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns

Key facts for FakeAgent AI platform lures

Detection coverage for FakeAgent AI platform lures

As of 2026-09-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2604 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: dscl Silent Password Validation Followed by Keychain/Browser Credential Archive Staging

Detects the AMOS/MacSync credential-theft sequence: dscl . -authonly used to silently validate the logged-in user's password, followed by access to Keychain Safe Storage / Chromium 'Login Data' / Firefox key4.db, and creation of a staging archive in /tmp (osalogging.zip, out.zip).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1555.001, T1555.003, T1552.001, T1560.001
• Data sources: osquery, macos_unified_log, endpoint_security_framework
• Severity: critical
• Confidence: high

Splunk SPL

index=osquery sourcetype="osquery:process_events"
| eval cmd=lower(cmdline)
| where cmd="*dscl*" AND cmd="*-authonly*"
| eval dscl_time=_time
| join type=left host user [ search index=osquery sourcetype="osquery:file_events" (path="*/Library/Keychains/*" OR path="*Login Data*" OR path="*key4.db*") | fields host user _time as cred_time path ]
| join type=left host user [ search index=osquery sourcetype="osquery:process_events" cmdline="*zip*/tmp/*" | fields host user _time as zip_time cmdline as zip_cmd ]
| where (cred_time-dscl_time)<300 AND (zip_time-cred_time)<300
| table dscl_time host user path zip_cmd

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "dscl" and ProcessCommandLine has "-authonly"
| project DeviceName, AccountName, DsclTime=Timestamp
| join kind=inner (
    DeviceFileEvents
    | where FolderPath has_any (@"/Library/Keychains/", "Login Data", "key4.db")
    | project DeviceName, CredTime=Timestamp, FileName, FolderPath
) on DeviceName
| where CredTime - DsclTime between (0min .. 5min)
| join kind=inner (
    DeviceProcessEvents
    | where ProcessCommandLine has "zip" and ProcessCommandLine has "/tmp/"
    | project DeviceName, ZipTime=Timestamp, ProcessCommandLine
) on DeviceName
| where ZipTime - CredTime between (0min .. 5min)
| project DsclTime, DeviceName, AccountName, FolderPath, ProcessCommandLine

Sigma

title: Silent dscl Password Validation Chained to Keychain/Browser Credential Theft and /tmp Archive Staging
id: 6d7e8f9a-3c4b-4d2e-8f1a-4b3c2d1e0f9a
status: experimental
description: Detects the AMOS/MacSync post-exploitation chain of a silent dscl -authonly password check, Keychain/browser credential-store access, and archiving of stolen data to a /tmp zip file.
references:
    - https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust
    - https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-21
tags:
    - attack.credential-access
    - attack.t1555.001
    - attack.t1555.003
    - attack.t1552.001
    - attack.collection
    - attack.t1560.001
logsource:
    category: process_creation
    product: macos
detection:
    selection_dscl:
        CommandLine|contains|all:
            - 'dscl'
            - '-authonly'
    selection_zip:
        CommandLine|contains:
            - 'zip'
            - '/tmp/'
    condition: selection_dscl or selection_zip
falsepositives:
    - Legitimate IT/helpdesk scripts that validate a user's password via dscl for account-recovery workflows
    - Backup or support tooling that zips files into /tmp for unrelated diagnostic purposes
level: high

Known false positives:

• Legitimate password-reset/support tooling using dscl -authonly
• Benign diagnostic scripts archiving unrelated files to /tmp

Tuning notes: Require all three stages (dscl validation, credential-store access, /tmp zip creation) within a tight 5-10 minute window on the same host/user before alerting at high severity; a single stage alone should route to a lower-severity watchlist.

• 🔒 ClickFix Base64 Clipboard-to-Terminal Execution Sourced from AI Chat Share Links · unlock with TL Creds
• 🔒 Malicious LaunchAgent/LaunchDaemon and Scheduled Task Persistence Tied to FakeAgent/MacSync/AMOS · unlock with TL Creds
• 🔒 MacSync Universal Mach-O RAT AES-Encrypted TLS Beacon to Known C2 · unlock with TL Creds
• 🔒 MacSync Server-Side AppleScript Stealer Invocation via osascript · unlock with TL Creds
• 🔒 Screen Recording TCC Grant Chained to Trojanized Ledger/Trezor Electron Wallet Overwrite · unlock with TL Creds
• 🔒 AMOS/FakeAgent Malicious Domain and IP C2 or Exfiltration Communication (Incl. Community-Sighted Sibling Infrastructure) · unlock with TL Creds
• 🔒 Fake Claude Desktop Malvertising Install Chain — Signed CEF Binary Side-Loading Tampered libcef.dll · unlock with TL Creds
• 🔒 SectopRAT EtherHiding BSC Smart-Contract C2 Resolution and Known-IOC Beaconing · unlock with TL Creds

Indicators of compromise for FakeAgent AI platform lures

As of 2026-09-21, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-2604.

Sample indicators (3 of 30)

• IP address: 85.206.161[.]241
• Domain: claude[.]ai[.]download-app[.]us
• URL: hxxps://claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

How FakeAgent AI platform lures works

Huntress documented three distinct but pattern-linked campaigns that exploit the same structural weakness: AI platforms let anyone publish content that is served from the platform's own trusted, certificate-valid domain, and that content can be surfaced via paid search ads or SEO. In the FakeAgent campaign (21-22 July 2026), attackers built a public Claude Artifact at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877 that pixel-perfectly imitated the Claude Desktop download page. Bing sponsored ads for "Claude Desktop app" pointed victims to the genuine claude.ai domain, where the artifact redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a malicious ClaudeDesktop.exe. That file was actually a legitimate, signed JetBrains Chromium Embedded Framework (jcef_helper.exe) binary abused for DLL side-loading against a tampered, VMProtect-packed libcef.dll, which dropped a second sideloading pair (a renamed IBM SPSS binary plus tempdir.dll) that performed GPU-based anti-VM checks (DXGI adapter IDs, VRAM thresholds, compute-shader timing) and used a DirectX shader to decrypt an embedded SectopRAT .NET payload. SectopRAT's C2 configuration was stored on the BNB Smart Chain (EtherHiding) across two contracts, yielding a chain of historical C2 IPs from May 2025 through an active address in June 2026. The malicious artifact drew 7,100 views before Anthropic removed it; at least 29 organizations were compromised in the 48-hour window. WHOIS/Validin analysis tied the redirect infrastructure to a single registrant email linked to ten domains dating back to December 2025, one of which (polse[.]us) was separately seized by Microsoft under Operation Endgame for hosting StealC infrastructure, and the libcef.dll side-loading technique was linked to an April 2026 malicious Docker Hub campaign. In the second campaign, a claude.ai/share link styled as an official Apple Support installation guide instructed victims to paste a single curl command into Terminal. That command kicked off a previously undocumented six-stage macOS malware family Huntress named MacSync: a thin base64/gzip zsh loader; a daemon function that fetches and runs an AppleScript stealer server-side (keeping the logic off-disk, gated behind a shared API key); the AppleScript itself, which validates the account password via dscl, harvests Keychain Safe Storage keys for 13+ Chromium browsers plus Firefox, Telegram session data, SSH/AWS/Kubernetes keys, and ~21 desktop wallet apps into /tmp/osalogging.zip; a universal Mach-O RAT installed as a LaunchAgent that beacons over TLS to 85.206.161[.]241:8443 with AES-256-CBC-encrypted JSON; a separately signed helper that requests Screen Recording TCC permission and shells out to screencapture; and a set of trojanized Electron wallet apps (Ledger Wallet, Ledger Live, Trezor Suite) that phish recovery-phrase seed words to attacker-registered drop domains. Because the lure sat on Anthropic's own certificate-valid infrastructure, none of the usual phishing indicators applied; the only tell was a small unverified-content disclaimer. In the third campaign (incident observed 5 December 2025), a Google search for "Clear disk space on macOS" surfaced SEO-poisoned, publicly shared ChatGPT and Grok conversations posing as legitimate troubleshooting advice. The conversations ended in ClickFix-style Terminal instructions; because macOS Gatekeeper does not inspect shell scripts or one-liners, the base64-encoded command executed without any prompt and pulled the AMOS macOS stealer, which validates the password via dscl -authonly, pipes it to sudo -S for silent root execution, installs a LaunchDaemon (com.finder.helper.plist) that relaunches a Mach-O helper every second, stages stolen browser, Keychain, and cryptocurrency-wallet data to /tmp/out.zip, and overwrites legitimate Ledger Wallet installations with a trojanized, ad-hoc-signed copy. All three campaigns share a common criminal playbook: register short-lived, thematically-named infrastructure; stage the lure entirely on a trusted AI vendor's own domain to defeat visual phishing cues; drive traffic via paid search placement or SEO; and monetize through commodity credential/financial-data theft rather than targeted espionage.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1574.001 DLL

Persistence

T1053.005 Scheduled Task; T1543.001 Launch Agent

Execution

T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.002 Malicious File

Command and Control

T1071.001 Web Protocols; T1102.002 Bidirectional Communication

Credential Access

T1552.001 Credentials In Files; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

defense-impairment

T1553.001 Gatekeeper Bypass

Collection

T1560.001 Archive via Utility

Resource Development

T1583.001 Domains; T1608.001 Upload Malware

Impact

T1657 Financial Theft

Remediation for FakeAgent AI platform lures

Immediate actions

• Block/monitor egress to claude.ai.download-app[.]us, downloading-api.it[.]com, 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com, agenticsora[.]com, malwareaudit[.]com, putuartana[.]com, wbehub[.]org, sanchang[.]org, main.sdhomeinspectors[.]com, and main.southcarolinacounselor[.]com
• Block/alert on connections to C2 IPs 2.24.131[.]246, 85.206.161[.]241:8443, 103.216.221[.]95, 45.94.47[.]205, and 45.94.47[.]186
• Hunt for the file hashes in this record across EDR telemetry, especially renamed JetBrains/IBM SPSS binaries paired with a co-located libcef.dll or tempdir.dll
• Search for LaunchAgent/LaunchDaemon plists matching com.apple.<8-hex>.hcpi*.plist or com.finder.helper.plist, and Windows scheduled tasks named DockerDesktop.exe

Workarounds

• Only download AI vendor desktop applications from the vendor's official, non-shareable download page, never from a search ad or a shared conversation/artifact link
• Verify digital signatures on downloaded installers before execution

Longer-term hardening

• Enforce application whitelisting to prevent unsigned or side-loaded DLLs from executing alongside signed vendor binaries
• Restrict clipboard-triggered/paste-to-terminal script execution and deploy EDR behavioral detection for curl-piped-to-shell one-liners on both macOS and Windows
• Monitor for newly created scheduled tasks, LaunchAgents/LaunchDaemons, and antivirus/Defender exclusion changes as a generic persistence signal
• Treat troubleshooting or installation commands sourced from AI chat platforms (ChatGPT, Grok, Claude) as untrusted input requiring origin verification before execution

Affected and fixed versions

• Anthropic — Claude Artifacts / claude.ai share links
  Vulnerable versions: public artifact/share publishing feature, all versions as of 2026
• OpenAI — ChatGPT shared conversations
  Vulnerable versions: public conversation-sharing feature, as of December 2025
• xAI — Grok shared conversations
  Vulnerable versions: public conversation-sharing feature, as of December 2025
• Microsoft — Windows (SectopRAT/FakeAgent target)
  Vulnerable versions: all supported Windows versions
• Apple — macOS (MacSync and AMOS target)
  Vulnerable versions: all supported macOS versions

Timeline of FakeAgent AI platform lures

• 2025-12-01 First of ten domains later linked by a shared registrant email (via WHOIS/Validin) to the FakeAgent redirect infrastructure begins appearing.
• 2025-12-05 Huntress observes an incident where a customer, searching Google for "Clear disk space on macOS", is led to a SEO-poisoned, publicly shared ChatGPT conversation delivering ClickFix-style Terminal commands that install the AMOS stealer.
• 2025-12-14 Huntress publishes "AI-Poisoning & AMOS Stealer: The Biggest Mac Threat", documenting the SEO-poisoned ChatGPT/Grok shared-conversation delivery chain for AMOS.
• 2026-04-01 Attackers reuse the identical tampered libcef.dll DLL side-loading technique in a separate malicious Docker Hub campaign, later attributed by Huntress to the same tooling lineage as FakeAgent.
• 2026-05-09 The redirect domain locked-ioc-15 is registered.
• 2026-05-30 Earliest historical SectopRAT C2 IP (locked-ioc-23) is recorded in BNB Smart Chain (EtherHiding) transaction data tied to the campaign's contracts.
• 2026-06-24 Microsoft, Europol, and partners execute an Operation Endgame action disrupting StealC and Amadey infostealer infrastructure; the domain locked-ioc-30, later linked to the FakeAgent registrant email, is among the seized StealC domains.
• 2026-07-21 FakeAgent campaign begins: a malicious Claude Artifact impersonating the Claude Desktop download page is served via Bing sponsored ads for "Claude Desktop app", redirecting victims through locked-ioc-15 and locked-ioc-17 to a SectopRAT-laced ClaudeDesktop.exe.
• 2026-07-22 The malicious Claude Artifact (7,100 views) is removed by Anthropic after compromising at least 29 organizations in roughly 48 hours.
• 2026-07-23 Huntress, BleepingComputer, Help Net Security, and IT Security Guru publish coordinated coverage of the FakeAgent/SectopRAT campaign, including the DLL side-loading chain, EtherHiding C2, and 29-organization impact figure.
• 2026-07-30 Huntress publishes "Reverse Engineering the Six Stages of MacSync Stealer and RAT", detailing a fake Apple Support install guide hosted on claude.ai/share that delivers a previously undocumented six-stage macOS stealer/RAT.
• 2026-08-01 Follow-on reporting (including a Ledger-focused writeup) highlights MacSync's targeting of desktop cryptocurrency wallet applications and trojanized Ledger/Trezor installers.
• 2026-09-11 Huntress publishes "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms", formally tying FakeAgent, MacSync, and the AMOS ChatGPT/Grok campaign together as a nine-month pattern; syndicated by BleepingComputer the same week.
• 2026-09-21 NSFOCUS publishes a consolidated incident-case report summarizing all three campaigns, triggering this threat record.

Sources cited for FakeAgent AI platform lures

• Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT Huntress · Research · 2026-07-23
• Reverse Engineering the Six Stages of MacSync Stealer and RAT Huntress · Research · 2026-07-30
• AI-Poisoning & AMOS Stealer: The Biggest Mac Threat Huntress · Research · 2025-12-14
• The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms Huntress · Research · 2026-09-11
• AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution nsfocusglobal.com · Blog · 2026-09-21
• How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface BleepingComputer · News · 2026-09-11
• Fake Claude app promoted by Bing ads pushes SectopRAT malware BleepingComputer · News · 2026-07-23
• How attackers hosted a fake Claude download page on the claude.ai domain Help Net Security · News · 2026-07-23
• FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations itsecurityguru.org · News · 2026-07-23
• Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds itsecurityguru.org · News · 2026-07-30
• Amadey, StealC malware operations disrupted in Operation Endgame action BleepingComputer · News · 2026-06-24
• Operation Endgame Takes Down StealC and Amadey Infostealers infosecurity-magazine.com · News · 2026-06-24

Threats related to FakeAgent AI platform lures

• Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
• MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar (SONOMAC1)
• Infostealer Malware Hijacks Claude Login Sessions to Bypass MFA and Drain Usage; Related FakeAgent Malvertising Campaign Deploys SectopRAT via Trojanized Claude Desktop Installer
• Infostealer Malware (Vidar, LummaC2, StealC, RedLine, Acreed, Atomic Stealer) Hijacking Claude Login Sessions to Drain Usage
• MacSync Stealer: Malvertising Campaign Impersonates Claude/Apple Support to Deploy macOS Infostealer

Related coverage of this activity

• Atomic Stealer ClickFix fingerprint gate
• FakeAgent malvertising campaign
• SectopRAT Bing ads lure

Previous and next in malware

• Rapuncel Infostealer Uses Microsoft-Signed Driver to Kill 145 Security Tools via Fake LastPass Authenticator GitHub Repos Previous report
• Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems Next report