Full Report
Threat actors are targeting the AI attack surface to deliver malware and steal data. See how trusted AI tools are being exploited today.
Analysis Summary
# Tool/Technique: AI Attack Surface Exploitation (FakeAgent & MacSync)
## Overview
This technique involves weaponizing the "trust boundary" of legitimate AI platforms (Anthropic Claude, OpenAI ChatGPT, Google Gemini) to deliver malware. Threat actors abuse shareable AI content, such as **Claude Artifacts** and public conversation links, to host malicious instructions or fake download pages. By hosting these on legitimate domains (e.g., `claude.ai`), attackers bypass traditional web filters and exploit user trust in established AI brands.
## Technical Details
- **Type:** Technique (Malware Delivery / Social Engineering) / Malware (SectopRAT, MacSync, GhostSocks)
- **Platform:** Windows, macOS
- **Capabilities:** Credential theft, browser cookie scraping, crypto wallet theft, remote access, and persistence via scheduled tasks.
- **First Seen:** Incidents tracked heavily starting November 2023; specific "FakeAgent" campaign identified July 2024.
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- **[T1566.002 - Phishing: Spearphishing Link]** (Use of legitimate `claude.ai/share` or `chatgpt.com` links)
- **[T1583.008 - Acquire Infrastructure: Malvertising]** (Sponsored search results leading to artifacts)
- **[TA0002 - Execution]**
- **[T1204.002 - User Execution: Malicious File]** (Users running fake `ClaudeDesktop.exe`)
- **[T1053.005 - Scheduled Task/Job: Scheduled Task]** (Persistence mechanism)
- **[TA0005 - Defense Evasion]**
- **[T1562.001 - Impair Defenses: Disable or Modify Tools]** (Modifying antivirus exclusions)
- **[TA0006 - Credential Access]**
- **[T1539 - Steal Web Session Cookie]**
- **[T1555 - Credentials from Password Stores]**
## Functionality
### Core Capabilities
- **Legitimate Domain Hosting:** Using Claude Artifacts to host HTML/JS that mimics official product download pages.
- **Search Engine Poisoning:** Leveraging sponsored search results to direct users looking for AI desktop apps to malicious AI-hosted links.
- **Information Stealing:** Exfiltrating sensitive data including browser history, saved passwords, and cryptocurrency keys.
### Advanced Features
- **Cross-Platform Targeting:** Specific campaigns tailored for macOS (MacSync) and Windows (SectopRAT).
- **Automated Workflows:** Using AI-generated code or "OpenClaw" fake installers to deploy multi-stage malware like GhostSocks.
## Indicators of Compromise
- **File Names:** `ClaudeDesktop.exe`, `ClaudeCode.dmg`, `OpenClaw_installer.exe`
- **Network Indicators:**
- `downloading-api[.]it[.]com` (Redirect domain)
- `claude.ai/artifacts/[unique_id]` (Note: specific malicious artifacts are often removed rapidly)
- `claude.ai/share/[unique_id]`
- **Behavioral Indicators:**
- Creation of new scheduled tasks shortly after executing a downloaded "AI tool."
- Unexpected modifications to Windows Defender or third-party AV exclusion lists.
- Scripts attempting to access `/tmp` folders or browser profile directories.
## Associated Threat Actors
- **General Cybercriminals:** Broad use for RAT and Infostealer distribution.
- **Nezha / China-Nexus Actors:** Linked to related toolsets (Ghost RAT) in webserver intrusions mentioned in context.
## Detection Methods
- **Behavioral Detection:** Monitor for processes spawning from browser downloads that immediately attempt to modify registry keys or schedule tasks.
- **Network Monitoring:** Alert on traffic to `it.com` subdomains originating from corporate environments following a visit to an AI platform.
- **Log Analysis:** Search for "unverified user-generated content" disclaimer strings in web proxy logs associated with AI domains.
## Mitigation Strategies
- **Technical Controls:**
- Restrict script execution from the clipboard.
- Implement application allow-listing (AppLocker/WDAC).
- Deploy ad blockers at the browser or DNS level to mitigate sponsored search risks.
- **Hardening:**
- Monitor and alert on any changes to Antivirus exclusion paths.
- Audit scheduled tasks created in the `\Users\` directory.
- **User Education:** Train users that AI platforms host user-generated content that is not vetted by the platform provider (Claude, OpenAI, etc.).
## Related Tools/Techniques
- **SectopRAT / FakeAgent:** The Windows-based RAT delivered via Claude Artifacts.
- **MacSync:** The macOS infostealer delivered via fake AI setup guides.
- **GhostSocks:** SOCKS5 proxy malware often bundled with fake AI installers.
- **Nezha:** A management tool used in tandem with these intrusions.