Attackers Abuse Trusted AI Platforms to Deliver Malware

Summary

Huntress says attackers used Claude Artifacts and shared Claude, ChatGPT, and Grok content to lure users into downloading malware or running commands that delivered SectopRAT, MacSync, and AMOS.

Key points

Huntress says the FakeAgent campaign reached more than 29 organizations through a fake Claude Desktop download page hosted as a Claude Artifact; victims were redirected to SectopRAT.
Anthropic removed the reported Artifact by July 22, but Huntress said incidents linked to the same redirect domain continued into August.
A fake Apple Support guide shared on claude[.]ai instructed a victim to paste a curl command into Terminal, deploying MacSync, which Huntress says harvested cookies, credentials, keychain secrets, Telegram sessions, and SSH and cloud keys.
Poisoned ChatGPT and Grok conversations promoted through search results gave ClickFix-style macOS troubleshooting instructions that delivered the AMOS stealer.
Huntress says the campaigns exploited user trust in legitimate platform features and domains, rather than breaking through the platforms’ security.
Recommended defenses include restricting clipboard-driven script execution, application allow-listing, monitoring for new scheduled tasks and antivirus exclusion changes, training users about ClickFix-style lures, and promptly reporting suspicious hosted content.

Article Details

Event Type: Malware-delivery campaigns abusing trusted AI platform features, shared content, and search placement to lure users into downloading malware or executing malicious commands.
Impact: Huntress reported that the FakeAgent campaign affected more than 29 organizations and delivered SectopRAT. Separate lures delivered the MacSync and AMOS stealers; the reported theft included cookies, credentials, keychain secrets, Telegram sessions, and SSH and cloud keys.