Loading story…
A malvertising campaign dubbed FakeAgent abused searches for the Claude Desktop app to deliver the SectopRAT information-stealing trojan to Windows users at at least 29 organizations. Victims who clicked sponsored Bing results were sent to a spoofed public artifact hosted on Anthropic's claude.ai domain instead of the legitimate download page, then redirected to attacker-controlled infrastructure that served a fake ClaudeDesktop.exe installer. Huntress said the activity ran from July 21 to 22 and should be treated as a full remote-access and credential-theft compromise, not a nuisance adware incident.
The malware chain used DLL sideloading through a tampered libcef.dll, signed-binary proxy execution, VMProtect packing, GPU-based anti-analysis, and DirectX shader-based payload decryption to evade detection. Researchers said SectopRAT established persistence with sslconf.exe, tempdir.dll, and appcfg.dat under AppData, and retrieved command data via blockchain infrastructure tied to contract 0xc1907d7be91f95903ad66d775c397302e7dd9228; Huntress also identified 2.24.131[.]246 as a live command-and-control address. The RAT is capable of stealing browser credentials, cookies, autofill and payment data, Chromium keys, FTP credentials, Discord and messaging data, files, and passwords, and the infrastructure was linked to earlier malicious activity dating to May 2025, including domains associated with campaigns tied to StealC infrastructure seized during Operation Endgame.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Help Net Security reports Huntress said the malicious public Claude Artifact used in the FakeAgent campaign was viewed 7,100 times before Anthropic removed it. This reflects a concrete response action by the platform following the abuse of the claude.ai domain.
Huntress linked infrastructure used in the FakeAgent campaign to prior malicious activity dating back to May 2025, including domains associated with earlier campaigns and infrastructure tied to StealC activity seized during Operation Endgame.
On July 22, 2026, Huntress reported the FakeAgent campaign, describing how a malicious public Claude artifact was used to distribute SectopRAT through a fake ClaudeDesktop.exe installer and attacker-controlled redirection chain.
Between July 21 and July 22, 2026, victims searching Bing for the Claude Desktop app clicked sponsored ads that led to a spoofed Claude Artifact and attacker-controlled infrastructure, resulting in SectopRAT infections. Huntress said at least 29 organizations were affected.
Operation Endgame publicly identified and seized infrastructure associated with StealC activity. Huntress later cited this seized infrastructure as part of the historical infrastructure overlap connected to the FakeAgent campaign.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
trojan-killer.net
Open sourceitsecurityguru.org
Open sourcehelpnetsecurity.com
Open sourcebleepingcomputer.com
Open sourceoperation-endgame.com
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malvertising and SEO-poisoning campaign is impersonating Anthropic’s Claude AI with the domain `claude-pro[.]com`, luring users to download a trojanized Windows installer that deploys a newly identified backdoor called **Beagle**. Researchers said the fake site appeared in sponsored search results and mimicked Claude branding to distribute a ZIP archive containing an MSI package that installed a legitimate signed G DATA executable alongside a malicious DLL, abusing **DLL sideloading** to begin the infection chain. After execution, the malware decrypts additional payloads, launches DonutLoader, and loads Beagle entirely in memory to reduce disk-based detection. The backdoor provides remote access functions including command execution, file transfer, directory management, and self-uninstallation, and communicates with `license[.]claude-pro[.]com` over TCP 443 or UDP 8080 using a hardcoded AES key. Sophos X-Ops said the campaign has been active for months, uses anti-analysis measures and shared tooling such as a reused XOR key, and relies on infrastructure including Cloudflare and Alibaba Cloud; researchers also noted overlaps with activity linked to **PlugX** operators and related impersonation of vendors including Trellix, CrowdStrike, SentinelOne, and Microsoft Defender.
Jun 29, 2026
A fake website impersonating Anthropic’s Claude AI service has been used to distribute the **PlugX remote access trojan**, luring victims with a trojanized ZIP archive advertised as a “pro” installer. The package launches a working Claude-themed application to avoid suspicion while a hidden VBScript begins the infection chain, abusing interest in AI tools as social-engineering cover for malware delivery. The script copies a legitimate signed **G DATA** executable and a malicious `avk.dll` into the Windows Startup folder, where DLL sideloading allows the trusted binary to load the rogue library. The DLL then decrypts and executes a payload stored in an encrypted `.dat` file, establishes persistence, modifies a TCP/IP-related Windows registry key, and connects over HTTPS to `8.217.190[.]58` hosted on Alibaba Cloud; researchers also said the campaign uses self-deleting scripts to reduce forensic visibility. While PlugX has long been linked to espionage activity, researchers cautioned that the malware is now broadly reused and the campaign cannot be attributed on tooling alone.
Jun 29, 2026
Threat actors are running a **ClickFix**-style social-engineering campaign that abuses **Google sponsored search results** to funnel macOS users to malicious content hosted on legitimate platforms, including **Anthropic Claude public artifacts** (`claude.ai`) and **Medium** pages impersonating trusted sources (e.g., Apple Support). The lures target common search queries such as “online DNS resolver,” “macOS CLI disk space analyzer,” and “HomeBrew,” then instruct victims to paste and run Terminal commands that decode/execute payloads (e.g., `echo "..." | base64 -D | zsh` or `curl ... | zsh`). Researchers (Moonlock Lab/MacPaw and AdGuard) reported that the malicious Claude artifact accumulated **~12,300 to 15,600 views**, indicating significant exposure (reported as **10,000+** and **15,000+** potential victims across coverage). The payloads deliver macOS information-stealing malware, including **MacSync**, which collects data such as **Keychain credentials, browser data, and cryptocurrency wallet files**. Reported tradecraft includes downloading and executing a shell script, using an AppleScript component for theft, staging stolen data into `/tmp/osalogging.zip`, and exfiltrating via HTTP POST to attacker infrastructure (e.g., `a2abotnet[.]com/gate`, with C2 paths like `a2abotnet[.]com/dynamic`). The malware attempts to blend in by spoofing legitimate macOS browser User-Agent strings and includes retry logic for large/chunked uploads, then removes staging artifacts to reduce forensic traces.
Jun 29, 2026