Overview
A malvertising campaign tracked as FakeAgent abused Bing’s paid search advertising platform and Anthropic’s legitimate Claude.ai domain to distribute the SectopRAT remote access trojan between July 21–22, 2026. At least 29 organisations were compromised before Anthropic removed the malicious Claude Artifact, which had already been downloaded 7,100 times. The campaign is notable for weaponising a trusted AI platform’s own infrastructure — Claude Artifacts — as a staging and hosting vector for phishing pages and malicious installers.
Technical Analysis
The infection chain operated in several stages:
Malvertising entry point: Sponsored Bing search results directed users searching for Claude desktop software to a phishing page hosted as a Claude Artifact on the legitimate
claude.aidomain, lending the lure significant visual and domain credibility.Fake installer delivery: Visitors were prompted to download
ClaudeDesktop.exe, which is actually a legitimate JetBrains Chromium component repurposed as a DLL sideloading carrier.DLL sideloading: The executable sideloads a malicious
libcef.dll, which executes the SectopRAT payload. This technique abuses the implicit trust Windows grants to signed parent processes.Persistence: A second executable,
DockerDesktop.exe, installs a scheduled task to maintain persistence across reboots.Anti-analysis hardening: Loaders incorporate VMProtect packing, shader timing checks, GPU/VRAM fingerprinting, and VM detection to frustrate sandboxed analysis environments.
C2 via EtherHiding: SectopRAT uses the EtherHiding technique — encoding C2 server addresses in Ethereum BNB Smart Chain transactions — to make infrastructure takedowns significantly harder.
SectopRAT (also known as ArechClient2, active since 2019) provides HVNC functionality, enabling real-time hidden desktop interaction. It targets passwords, credit card data, browser cookies, FTP credentials, Discord, Telegram, Steam, and VPN client data.
In a notable defensive twist, Huntress researchers used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET payload analysis — demonstrating AI-assisted threat intelligence as a countermeasure to AI-platform-abusing attacks.
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): Attackers exploited the Claude AI brand and platform infrastructure as a delivery mechanism, abusing user trust in a widely recognised AI product.
- AML.T0010 (ML Supply Chain Compromise): The Claude Artifact ecosystem was used as an unofficial software distribution channel, functioning analogously to a compromised supply chain node.
- LLM05 (Supply Chain Vulnerabilities): The abuse of Claude Artifacts highlights gaps in how AI platforms vet and moderate user-generated content that can execute or redirect to executable downloads.
- LLM02 (Insecure Output Handling): Artifacts serving active phishing pages represent a failure mode in output sandboxing for AI-generated interactive content.
Impact Assessment
With 29 confirmed organisational compromises in under 48 hours and 7,100 artifact downloads, the blast radius is significant. SectopRAT’s HVNC capability means attackers can conduct live, hands-on operations on compromised hosts without victim awareness. The EtherHiding C2 mechanism complicates takedown efforts, extending attacker dwell time. The campaign also demonstrates that AI platform trust is now an active threat surface exploitable for social engineering at scale.
Mitigation & Recommendations
- Web filtering: Block or flag downloads of executables originating from
claude.aisubdomains unless explicitly approved. - EDR rules: Create detection logic for
libcef.dllloaded by non-browser processes and for scheduled tasks created byDockerDesktop.exe. - Ad-block and DNS policies: Consider blocking Bing sponsored results for high-risk software search terms in managed environments.
- User awareness: Educate users that legitimate AI tools should be downloaded exclusively from official vendor sites, not search ads.
- Platform advocacy: Encourage AI vendors (including Anthropic) to implement stricter content moderation and executable-link scanning within Artifact hosting environments.