Full Report
On July 21 and July 22, Huntress observed a number of attacks that started with a malicious public Claude Artifact hosted on a legitimate Claude domain, and ended in organizations being infected by the SectopRAT stealer.
Analysis Summary
# Incident Report: FakeAgent Malvertising Campaign
## Executive Summary
Between July 21 and July 22, 2026, a sophisticated malvertising campaign targeted 29 organizations by exploiting the legitimacy of the Claude AI platform. Attackers utilized SEO poisoning and sponsored search results to direct users to a malicious public Claude Artifact, which served as a gateway for downloading a fraudulent "Claude Desktop" application. The final payload was SectopRAT, a remote access trojan designed to exfiltrate sensitive financial and personal data.
## Incident Details
- **Discovery Date:** July 21, 2026
- **Incident Date:** July 21–22, 2026
- **Affected Organization:** 29 distinct organizations
- **Sector:** Multi-sector
- **Geography:** Global / Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** July 21, 2026
- **Vector:** SEO Poisoning / Malvertising via Bing Search
- **Details:** Users searching for "CLAUDE DESKTOP APP" were presented with sponsored links. One link directed users to a legitimate-appearing public artifact hosted on `claude[.]ai`. This artifact redirected users to an external attacker-controlled domain to download a malicious `ClaudeDesktop.exe`.
### Lateral Movement
- **Details:** The report highlights the deployment of a Remote Access Trojan (RAT) with HVNC (Hidden Virtual Network Computing) capabilities, which typically facilitates lateral movement and persistent administrative control within a network.
### Data Exfiltration/Impact
- **Details:** The SectopRAT payload targeted credit card data, personal identifiable information (PII), stored passwords, and local files.
### Detection & Response
- **Discovery:** Huntress SOC observed a spike in unusual executable installs, Defender exclusions, and anomalous persistence mechanisms.
- **Response Actions:** Analysts used Claude AI (Opus 4.8) to assist in reverse-engineering the malware’s anti-analysis features. The malicious artifact was reported to Anthropic and subsequently removed.
## Attack Methodology
- **Initial Access:** Malvertising and exploitation of trusted third-party hosting (Claude Artifacts).
- **Persistence:** Created anomalous persistence mechanisms (specifics redacted/truncated in text) and Windows Defender exclusions.
- **Defense Evasion:** Use of **VMProtect** to prevent reverse engineering and hardware checks (graphics hardware) to detect and avoid sandbox/VM environments.
- **Credential Access:** Automated siphoning of browser-stored passwords and credit card info.
- **Lateral Movement:** HVNC (Hidden Virtual Network Computing) for stealthy remote control.
- **Exfiltration:** C2 communication utilizing data stored/retrieved via Ethereum BSC (Binance Smart Chain) transactions.
- **Impact:** Financial theft and data breach through SectopRAT.
## Impact Assessment
- **Financial:** High risk due to targeted theft of credit card information.
- **Data Breach:** Compromise of PII and credentials across 29 organizations.
- **Operational:** Potential for full system takeover via RAT capabilities.
- **Reputational:** Exploitation of the "Claude" brand and the legitimate `claude.ai` domain to bypass user suspicion.
## Indicators of Compromise
- **Network Indicators:** `claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877` (Defanged)
- **File Indicators:** `ClaudeDesktop.exe` (Malicious loader)
- **Behavioral Indicators:** Unexpected Windows Defender exclusions; unusual outbound traffic to Ethereum blockchain-related services.
## Response Actions
- **Containment:** Removal of the malicious hosting artifact by Anthropic.
- **Eradication:** SOC-led termination of malicious processes and removal of persistence triggers across the 29 affected environments.
- **Recovery:** Restoration of security configurations (removing unauthorized Defender exclusions).
## Lessons Learned
- **Trusted Domain Abuse:** Attackers are increasingly hosting malicious redirection logic on legitimate SaaS platforms (Claude, GitHub, etc.) to bypass web filters.
- **Search Risks:** Sponsored search results remain a high-risk vector; users often trust the first result regardless of the "Sponsored" tag.
- **AI as a Tool:** LLMs can be utilized effectively by defenders to speed up the analysis of complex, packed malware.
## Recommendations
- **User Education:** Train employees to verify download sources even when the domain appears legitimate (e.g., verifying against official product release notes).
- **Ad-Blocking:** Implement enterprise-wide ad-blocking to mitigate malvertising risks.
- **Monitoring:** Implement detection for unauthorized changes to Windows Defender exclusion lists.
- **Artifact Control:** Organizations using AI tools should monitor for the creation/sharing of public artifacts that could be used for shadow IT or malicious purposes.