Loading story…
Huntress documented malware-delivery campaigns that weaponized public, indexable content on trusted AI platforms—including Claude, ChatGPT, and Grok—without exploiting vulnerabilities in those services. In one campaign, Bing malvertising directed users searching for Claude Desktop to a fraudulent Claude Artifact hosted on the legitimate claude.ai domain, affecting more than 29 organizations and delivering the SectopRAT remote-access trojan.
Other campaigns used a fake Apple Support installation guide on claude.ai/share to deploy the MacSync macOS malware and SEO-poisoned ChatGPT and Grok conversations to distribute the AMOS infostealer. The attacks exploit confidence in recognizable domains, prominent search results, and copied terminal commands; organizations should require official software download channels, treat AI-supplied commands as untrusted, restrict clipboard-triggered script execution, enforce application allowlisting, and monitor for scheduled-task creation and antivirus-exclusion changes.
Get the infrastructure and lures behind it.
7 events from the most recent confirmed update back to the earliest known activity.
Huntress released case research covering a nine-month set of malware-delivery campaigns that abused public and indexable content features on Claude, ChatGPT, and Grok without breaching the platforms' security controls.
Redirect domains associated with the FakeAgent campaign continued to be used into August 2026 after the malicious Claude Artifact was removed.
The fraudulent Claude Artifact was reported to Anthropic and removed after accumulating approximately 7,100 views.
A Bing sponsored advertisement targeting searches for the Claude desktop client redirected victims to a fraudulent Claude Desktop or Claude Cowork Artifact hosted on claude.ai. The FakeAgent campaign affected employees at more than 29 organizations within two days and delivered the SectopRAT remote-access trojan through a DLL side-loading chain.
Attackers used SEO poisoning to promote malicious shared ChatGPT and Grok conversations for macOS troubleshooting searches. The pages presented ClickFix-style Terminal commands that deployed the AMOS stealer.
WHOIS and Validin data linked the registration email used for download-app[.]us to ten domains registered beginning in December 2025.
A claude.ai/share page impersonating Apple Support instructed macOS users to paste a curl command into Terminal, initiating a six-stage infection chain that deployed the MacSync stealer. MacSync targeted browser cookies, credentials, Keychain secrets, Telegram sessions, SSH keys, and cloud-service keys.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors have launched sophisticated malware campaigns that exploit legitimate AI chat platforms, such as ChatGPT and Grok, to deliver malicious code to unsuspecting users. By using SEO poisoning and sponsored Google search results, attackers redirect users searching for common macOS troubleshooting tips to fake shared chat links on these AI platforms. These chats appear to offer helpful system instructions but actually embed obfuscated, base64-encoded commands that, when executed, install multi-stage malware. The infection process often involves social engineering tactics, such as prompting users to enter their system password under the guise of credential verification, which is then used to escalate privileges and deploy the main malware payload. Security researchers have identified the malware as variants of information stealers, including Shamus and AMOS, which are capable of stealing credentials and cryptocurrency, and employ advanced evasion techniques like multi-layered encoding and custom decoders to avoid detection. This attack method is particularly effective because it leverages the inherent trust users place in well-known AI brands and their official domains, bypassing traditional safety checks. The campaigns highlight a growing trend in cybercrime where legitimate AI tools are weaponized to facilitate malware delivery, making detection and prevention more challenging. Security analysts emphasize the need for increased vigilance when interacting with AI-generated content, especially when prompted to execute system commands, and recommend enhanced monitoring for suspicious activity originating from AI platform interactions.
Jun 29, 2026
Attackers are targeting macOS users with fake AI tool downloads promoted through **Google Ads** and public **Claude.ai** shared chats. Victims searching for terms such as “Claude mac download” are shown sponsored results that appear to reference the legitimate `claude.ai` domain, but the links redirect to shared chats containing bogus installation instructions. The lures present themselves as official guidance for running Claude-related tools on Mac, sometimes even masquerading as Apple Support content, and tell users to paste commands into Terminal that instead fetch and execute malware. Researchers said the campaign is active and uses rotating malicious chat pages and infrastructure to evade disruption. Observed payloads include Mac-focused infostealers with behavior consistent with **AMOS** and **Amatera/MacSync-style** theft, including collection of browser credentials, cookies, and **Keychain** data. The activity reflects a broader trend of threat actors disguising malware as AI agents and developer tools to exploit demand for generative AI software on macOS systems.
Jun 29, 2026
A malvertising campaign used sponsored Google search results for Anthropic's Claude to lure macOS users to a legitimate shared conversation page on `claude.ai`, where they were socially engineered into running a malicious terminal command. Huntress reported that the command fetched MacSync, a multi-stage macOS infostealer and remote access trojan that chains a `zsh` loader, in-memory AppleScript theft, a persistent Mach-O RAT, and a helper component designed to abuse Screen Recording permissions. The malware was built to steal a wide range of data from infected Macs, including browser data, Keychain secrets, saved passwords, Telegram sessions, SSH and cloud credentials, and cryptocurrency wallet recovery phrases. The operation also used repeated TCC permission prompts, fake "Apple Support" messaging, and trojanized cryptocurrency wallet applications to deepen access, maintain persistence, and expand theft beyond initial credential harvesting.
Aug 20, 2026