FakeAgent Campaign: Malicious Claude.ai Artifact Delivers SectopRAT to 29 Orgs

A malvertising operation dubbed “FakeAgent” compromised 29 organizations in a single 24-hour window last week, exploiting Anthropic’s own Claude.ai domain to distribute the SectopRAT credential-stealing Trojan.

The campaign, detailed by Huntress researcher Michael Tigges, shows how attackers are weaponizing trust in AI platforms themselves rather than merely mimicking them.

Between July 21 and July 22, 2026, victims searching Bing for “Claude Desktop App” encountered sponsored results that appeared to link directly to the legitimate Claude.ai domain.

FakeAgent Campaign

Instead of a normal product page, the ad routed users to a public Claude Artifact, a user-generated content feature Anthropic allows for sharing simple demos that had been repurposed as a convincing fake download page.

The artifact, which racked up 7,100 page views before Anthropic removed it following Huntress’ report, redirected victims through claude.ai.download-app[.]us and a secondary domain to deliver a booby-trapped ClaudeDesktop.exe.

“This campaign is a reminder that zero-trust thinking has to extend beyond corporate networks and into the browser bar itself; a domain being ‘real’ no longer means the content on it is safe, especially as AI platforms increasingly host user-generated artifacts with minimal vetting,” said Huntress.

The malware chain relied on DLL sideloading, abusing a legitimate JetBrains component (jcef_helper.exe) alongside a tampered libcef.dll to execute malicious code under a trusted, signed binary. A second stage disguised itself as IBM SPSS software, again using sideloading via a poisoned tempdir.dll.

That file employed a GPU-based anti-VM gate, inspecting graphics hardware identifiers and VRAM allocation to detect sandboxes before executing its payload a technique that also delegated payload decryption to a DirectX shader rather than standard CPU cryptography, complicating traditional reverse engineering.

The primary payload was further packed with VMProtect, a commercial obfuscation tool frequently abused by threat actors to resist analysis. Huntress ultimately identified the malware as SectopRAT, a remote access trojan capable of harvesting browser credentials, cookies, autofill data, credit card numbers, and cryptocurrency wallet information.

Rather than relying on conventional, easily-seized infrastructure, the attackers embedded command-and-control instructions inside Ethereum Binance Smart Chain transactions a resilience technique known as “EtherHiding”.

This lets operators rotate C2 addresses simply by posting new blockchain transactions, making takedown efforts far more difficult than with traditional domain-based infrastructure.

Huntress traced the technique to a live C2 address (2.24.131[.]246) and linked historical BSC transactions back to an initial transaction dated May 30, 2025, suggesting the infrastructure predates this specific campaign by over a year.

Using WHOIS records and the Validin intelligence platform, Huntress connected the registrant email behind the malicious domains to at least 10 other phishing and malware-distribution sites dating back to December 2025, including one seized by Microsoft’s Operation Endgame for hosting StealC infostealer malware.

Researchers also tied the same actor to an April 2026 campaign that distributed fake Docker Desktop installers via Docker Hub using nearly identical sideloading tactics.

This incident fits a broader, escalating trend: separate research from EclecticIQ, Bitdefender, and Trend Micro has documented similar SEO-poisoning and malvertising campaigns impersonating Claude, Gemini CLI, and other AI developer tools throughout 2026.

As AI adoption accelerates, these platforms are becoming prime real estate for attackers exploiting the trust users place in recognizable brand domains.