Loading story…
A FakeAgent campaign is using malicious search advertisements and counterfeit Claude Desktop download pages to deliver the SectopRAT remote-access trojan to Windows users. The trojanized installer reportedly executes PowerShell to add Microsoft Defender exclusions, then uses DLL sideloading via a signed Java Chromium Embedded Framework helper and creates a disguised elevated scheduled task for persistence. Associated indicators include Claude-themed download infrastructure, lookalike application components, and IP address 153.75.84.173.
SectopRAT retrieves encrypted connection information through EtherHiding, using Ethereum blockchain data instead of a conventional command-and-control server. Organizations should isolate potentially affected endpoints, identify and remove unauthorized Defender exclusions and scheduled tasks, revoke credentials and active sessions used on exposed hosts, review identity activity, and reimage systems where execution is confirmed.
Get the infrastructure and lures behind it.
3 events from the most recent confirmed update back to the earliest known activity.
Responders isolated the affected device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to determine whether stolen credentials had been used elsewhere.
The malware created an elevated logon-triggered scheduled task named MicrosoftEdgeUpdate that launched a staged DockerDesktop.exe loader from a user-writable roaming-profile directory. SectopRAT retrieved encrypted connection details using EtherHiding and Ethereum blockchain data rather than a fixed conventional command-and-control server.
A campaign assessed as FakeAgent used malicious search advertisements and spoofed Claude desktop download pages to deliver trojanized Windows installers, culminating in the SectopRAT remote-access trojan. The installers used PowerShell to add Microsoft Defender exclusions and DLL sideloading through a signed Java Chromium Embedded Framework helper.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malvertising campaign dubbed **FakeAgent** abused searches for the Claude Desktop app to deliver the **SectopRAT** information-stealing trojan to Windows users at at least **29 organizations**. Victims who clicked sponsored Bing results were sent to a spoofed public artifact hosted on Anthropic's `claude.ai` domain instead of the legitimate download page, then redirected to attacker-controlled infrastructure that served a fake `ClaudeDesktop.exe` installer. Huntress said the activity ran from July 21 to 22 and should be treated as a full remote-access and credential-theft compromise, not a nuisance adware incident. The malware chain used **DLL sideloading** through a tampered `libcef.dll`, **signed-binary proxy execution**, **VMProtect** packing, GPU-based anti-analysis, and DirectX shader-based payload decryption to evade detection. Researchers said SectopRAT established persistence with `sslconf.exe`, `tempdir.dll`, and `appcfg.dat` under `AppData`, and retrieved command data via blockchain infrastructure tied to contract `0xc1907d7be91f95903ad66d775c397302e7dd9228`; Huntress also identified `2.24.131[.]246` as a live command-and-control address. The RAT is capable of stealing browser credentials, cookies, autofill and payment data, Chromium keys, FTP credentials, Discord and messaging data, files, and passwords, and the infrastructure was linked to earlier malicious activity dating to May 2025, including domains associated with campaigns tied to StealC infrastructure seized during Operation Endgame.
Aug 10, 2026
A malvertising and SEO-poisoning campaign is impersonating Anthropic’s Claude AI with the domain `claude-pro[.]com`, luring users to download a trojanized Windows installer that deploys a newly identified backdoor called **Beagle**. Researchers said the fake site appeared in sponsored search results and mimicked Claude branding to distribute a ZIP archive containing an MSI package that installed a legitimate signed G DATA executable alongside a malicious DLL, abusing **DLL sideloading** to begin the infection chain. After execution, the malware decrypts additional payloads, launches DonutLoader, and loads Beagle entirely in memory to reduce disk-based detection. The backdoor provides remote access functions including command execution, file transfer, directory management, and self-uninstallation, and communicates with `license[.]claude-pro[.]com` over TCP 443 or UDP 8080 using a hardcoded AES key. Sophos X-Ops said the campaign has been active for months, uses anti-analysis measures and shared tooling such as a reused XOR key, and relies on infrastructure including Cloudflare and Alibaba Cloud; researchers also noted overlaps with activity linked to **PlugX** operators and related impersonation of vendors including Trellix, CrowdStrike, SentinelOne, and Microsoft Defender.
Jun 29, 2026
A fake website impersonating Anthropic’s Claude AI service has been used to distribute the **PlugX remote access trojan**, luring victims with a trojanized ZIP archive advertised as a “pro” installer. The package launches a working Claude-themed application to avoid suspicion while a hidden VBScript begins the infection chain, abusing interest in AI tools as social-engineering cover for malware delivery. The script copies a legitimate signed **G DATA** executable and a malicious `avk.dll` into the Windows Startup folder, where DLL sideloading allows the trusted binary to load the rogue library. The DLL then decrypts and executes a payload stored in an encrypted `.dat` file, establishes persistence, modifies a TCP/IP-related Windows registry key, and connects over HTTPS to `8.217.190[.]58` hosted on Alibaba Cloud; researchers also said the campaign uses self-deleting scripts to reduce forensic visibility. While PlugX has long been linked to espionage activity, researchers cautioned that the malware is now broadly reused and the campaign cannot be attributed on tooling alone.
Jun 29, 2026