# Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns

> Across a nine-month span (December 2025-September 2026), criminal actors abused the public-sharing features of Claude Artifacts, claude.ai/share, ChatGPT, and Grok to host convincing malware lures directly on trusted AI-vendor domains, delivering the SectopRAT .NET RAT (29+ organizations, July 2026), the newly documented MacSync macOS stealer/RAT, and the AMOS macOS stealer (December 2025) with no spoofed domains or certificate warnings to warn victims.

- **Published:** 2026-09-21T00:00:00Z
- **Last reviewed:** 2026-09-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2604
- **ID:** TL-2026-2604
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress documented three distinct but pattern-linked campaigns that exploit the same structural weakness: AI platforms let anyone publish content that is served from the platform's own trusted, certificate-valid domain, and that content can be surfaced via paid search ads or SEO. In the FakeAgent campaign (21-22 July 2026), attackers built a public Claude Artifact at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877 that pixel-perfectly imitated the Claude Desktop download page. Bing sponsored ads for "Claude Desktop app" pointed victims to the genuine claude.ai domain, where the artifact redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a malicious ClaudeDesktop.exe. That file was actually a legitimate, signed JetBrains Chromium Embedded Framework (jcef_helper.exe) binary abused for DLL side-loading against a tampered, VMProtect-packed libcef.dll, which dropped a second sideloading pair (a renamed IBM SPSS binary plus tempdir.dll) that performed GPU-based anti-VM checks (DXGI adapter IDs, VRAM thresholds, compute-shader timing) and used a DirectX shader to decrypt an embedded SectopRAT .NET payload. SectopRAT's C2 configuration was stored on the BNB Smart Chain (EtherHiding) across two contracts, yielding a chain of historical C2 IPs from May 2025 through an active address in June 2026. The malicious artifact drew 7,100 views before Anthropic removed it; at least 29 organizations were compromised in the 48-hour window. WHOIS/Validin analysis tied the redirect infrastructure to a single registrant email linked to ten domains dating back to December 2025, one of which (polse[.]us) was separately seized by Microsoft under Operation Endgame for hosting StealC infrastructure, and the libcef.dll side-loading technique was linked to an April 2026 malicious Docker Hub campaign. In the second campaign, a claude.ai/share link styled as an official Apple Support installation guide instructed victims to paste a single curl command into Terminal. That command kicked off a previously undocumented six-stage macOS malware family Huntress named MacSync: a thin base64/gzip zsh loader; a daemon function that fetches and runs an AppleScript stealer server-side (keeping the logic off-disk, gated behind a shared API key); the AppleScript itself, which validates the account password via dscl, harvests Keychain Safe Storage keys for 13+ Chromium browsers plus Firefox, Telegram session data, SSH/AWS/Kubernetes keys, and ~21 desktop wallet apps into /tmp/osalogging.zip; a universal Mach-O RAT installed as a LaunchAgent that beacons over TLS to 85.206.161[.]241:8443 with AES-256-CBC-encrypted JSON; a separately signed helper that requests Screen Recording TCC permission and shells out to screencapture; and a set of trojanized Electron wallet apps (Ledger Wallet, Ledger Live, Trezor Suite) that phish recovery-phrase seed words to attacker-registered drop domains. Because the lure sat on Anthropic's own certificate-valid infrastructure, none of the usual phishing indicators applied; the only tell was a small unverified-content disclaimer. In the third campaign (incident observed 5 December 2025), a Google search for "Clear disk space on macOS" surfaced SEO-poisoned, publicly shared ChatGPT and Grok conversations posing as legitimate troubleshooting advice. The conversations ended in ClickFix-style Terminal instructions; because macOS Gatekeeper does not inspect shell scripts or one-liners, the base64-encoded command executed without any prompt and pulled the AMOS macOS stealer, which validates the password via dscl -authonly, pipes it to sudo -S for silent root execution, installs a LaunchDaemon (com.finder.helper.plist) that relaunches a Mach-O helper every second, stages stolen browser, Keychain, and cryptocurrency-wallet data to /tmp/out.zip, and overwrites legitimate Ledger Wallet installations with a trojanized, ad-hoc-signed copy. All three campaigns share a common criminal playbook: register short-lived, thematically-named infrastructure; stage the lure entirely on a trusted AI vendor's own domain to defeat visual phishing cues; drive traffic via paid search placement or SEO; and monetize through commodity credential/financial-data theft rather than targeted espionage.

## MITRE ATT&CK

- T1583.001 Domains
- T1608.001 Upload Malware
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1053.005 Scheduled Task
- T1543.001 Launch Agent
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1553.001 Gatekeeper Bypass
- T1140 Deobfuscate/Decode Files or Information
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1552.001 Credentials In Files
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1102.002 Bidirectional Communication
- T1657 Financial Theft

## Sources

- [AI Security Incident Case: Trusted AI Platforms Become a New Channel for Malware Distribution](https://nsfocusglobal.com/ai-security-incident-case-trusted-ai-platforms-become-a-new-channel-for-malware-distribution/)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [AI-Poisoning & AMOS Stealer: The Biggest Mac Threat](https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust)
- [The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms](https://www.huntress.com/blog/ai-attack-surface)
- [How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface](https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/)
- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)
- [How attackers hosted a fake Claude download page on the claude.ai domain](https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/)
- [FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations](https://www.itsecurityguru.org/2026/07/23/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations/)
- [Fake Claude Install Guide Delivers Six-Stage macOS Stealer and RAT, Huntress Finds](https://www.itsecurityguru.org/2026/07/30/fake-claude-install-guide-delivers-six-stage-macos-stealer-and-rat-huntress-finds/)
- [Amadey, StealC malware operations disrupted in Operation Endgame action](https://www.bleepingcomputer.com/news/security/amadey-stealc-malware-operations-disrupted-in-operation-endgame-action/)
- [Operation Endgame Takes Down StealC and Amadey Infostealers](https://www.infosecurity-magazine.com/news/operation-endgame-stealc-amadey/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2604