Attackers Abuse Trusted AI Platforms to Deliver Malware
Summary
Huntress describes campaigns using public AI content and sponsored search results to lure users into running commands that install SectopRAT, MacSync, and AMOS malware, and outlines steps defenders and users can take to reduce risk.
Key points
- A fake Claude Desktop download page hosted as a public Claude Artifact redirected users to SectopRAT; Huntress linked the campaign to incidents at more than 29 organizations.
- A sponsored Google result led a victim to a fake Apple Support guide in a shared Claude conversation, which prompted a Terminal command that launched a six-stage MacSync stealer infection.
- Attackers used indexed ChatGPT and Grok conversations to present malicious commands as macOS troubleshooting advice, leading to AMOS stealer downloads.
- The campaigns exploit trust in legitimate AI domains, user-generated content, and prominent search results; lures can remain available long enough to attract victims before removal.
- Huntress recommends restricting clipboard-driven script execution, application allow-listing, and monitoring for new scheduled tasks and antivirus exclusion changes.
- Users can reduce exposure to sponsored-search lures with ad blockers and should treat requests to paste commands into Terminal or PowerShell with caution.
Article Details
- Attack Vectors
- Malicious Claude Artifacts impersonated Claude Desktop or Claude Cowork download pages and redirected users to downloading-api[.]it[.]com to deliver SectopRAT.
- A sponsored search result led a victim to a public Claude conversation posing as an Apple Support install guide; it instructed the victim to paste a command into Terminal, launching a MacSync stealer kill chain.
- Shared ChatGPT and Grok conversations surfaced through search results and gave ClickFix-like instructions that prompted users to run Terminal commands, leading to AMOS stealer downloads.
- A reported variant used sponsored Google Search results to promote a fake OpenAI Codex download and persuade macOS victims to paste a malicious Terminal command, ending in AMOS malware.
- Defensive Notes
- Restrict script execution from the clipboard and enforce application allow-listing.
- Monitor for new scheduled tasks and changes to antivirus exclusions.
- Train users to recognize ClickFix-style lures and treat requests to paste commands into Terminal or PowerShell as a security concern.
- Individuals can use ad blockers to reduce exposure to sponsored-search risks.
- Report malicious content to platform vendors promptly.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | downloading-api[.]it[.]com | Malicious redirect domain used in the Claude Artifact campaign to lead victims to a SectopRAT download. |
MITRE ATT&CK
People
Malware
Atomic macOS Stealer (AMOS)targets run Terminal commands to "clean up" the system. These commands actually led to the download of the AMOS stealer. MacSynctold the victim to paste a curl command into Terminal. This launched a six-stage kill chain for the MacSync stealer that resulted in the comprehensive theft of cookies, credentials, keychain secrets, TelegramSectopRATto an external domain (downloading-api[.]it[.]com), which ultimately led to the download of malware (SectopRAT).
Vendors
Anthropicand shared by any user and are meant for lightweight things like demos, charts, or one-page sites, Anthropic doesn't vet their content beyond a generic disclaimer shown on every artifact page stating: "Content isGoogleHuntress investigated an incident where a victim searching Google for Claude on Mac clicked a sponsored result and followed a claude.ai/share conversation posing as an Apple Support guide. OpenAIit. AI security discussions often focus on attacks against AI companies and models (such as the recent OpenAI-HuggingFace intrusion). However, the Huntress Security Operations Center (SOC) is seeing a more prolific,
Products
ChatGPTAs more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware.ClaudeAs more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware.Claude CoworkClaude Artifact on the actual Claude AI domain. The artifact visually impersonated a Claude Desktop / Claude Cowork download page. This appeared to be a legitimate download link for the desktop app (ClaudeDesktop.exe)Claude DesktopFigure 1: Claude Desktop/Cowork phishing page hosted as a Claude Artifact.GeminiAs more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware.GrokAs more people use AI models such as Claude, ChatGPT, Grok, and Gemini, threat actors are abusing trusted AI platforms in a variety of ways to trick users into downloading malware.macOSIn December, an ordinary search for "Clear disk space on macOS" led a Mac user into high-ranked ChatGPT and Grok conversations, hosted on their respective legitimate platforms. Both conversations gave "advice" on how toOpenAI Codexresearchers in August reporting other variants of this attack that specifically involve a fake OpenAI Codex download. Like the one that we saw, this other variant of the attack involved sponsored results via