Fake Claude App Promoted in Bing Ads Delivers SectopRAT Malware
Summary
Huntress says a Bing malvertising campaign used a fake Claude desktop installer to deliver SectopRAT, compromising at least 29 organizations. The chain used DLL sideloading and anti-analysis checks; the malware retrieves C2 addresses via Ethereum transactions.
Key points
- Huntress reports that the FakeAgent campaign compromised at least 29 organizations between July 21 and 22; it did not attribute the campaign to a known threat cluster.
- Bing ads led users to a malicious Claude Artifact hosted on the legitimate Claude[.]ai domain. Huntress says it was downloaded 7,100 times before Anthropic removed it.
- A fake ClaudeDesktop.exe installer used a legitimate JetBrains Chromium component to sideload a malicious libcef.dll and deliver SectopRAT.
- A separate DockerDesktop.exe executable installed a scheduled task for persistence.
- Loaders and staging components used anti-analysis measures including VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual-machine detection.
- SectopRAT, also known as ArechClient2, can steal credentials and other user data and provides hidden remote-access functionality. It retrieves C2 addresses through Ethereum BNB Smart Chain transactions.
- Analysis of the decrypted .NET payload supported attribution to SectopRAT operations or a closely related fork; Huntress found related infrastructure but said evidence was insufficient to identify a known threat cluster.
Article Details
- Attack Vectors
- Bing ads promoted a fake Claude desktop app installer, which was delivered through a malicious Claude Artifact hosted on the legitimate Claude.ai domain.
- A legitimate JetBrains Chromium component sideloaded a malicious DLL to deliver SectopRAT.
- Another executable, DockerDesktop.exe, installed a scheduled task for persistence.
- Loaders and staging components used VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual-machine detection.
- SectopRAT retrieved a working command-and-control address from Ethereum BNB Smart Chain transactions.
- Defensive Notes
- Download software from official websites and download portals rather than search results, especially sponsored results.
MITRE ATT&CK
T1027.002 · Software PackingLoaders and staging components used VMProtect packing.T1053.005 · Scheduled TaskDockerDesktop.exe installed a scheduled task to maintain persistence.T1497.001 · System ChecksThe infection chain used virtual-machine detection and GPU/VRAM checks.T1497.003 · Time Based ChecksThe infection chain used shader timing checks as an anti-analysis measure.T1555.003 · Credentials from Web BrowsersSectopRAT targeted browser logins and cookies.T1574.002 · DLL Side-LoadingA legitimate JetBrains Chromium component sideloaded a malicious libcef.dll to deliver SectopRAT.
Malware
ArechClient2SectopRAT, also known as ArechClient2, has been active since 2019 and is an information-stealer with HVNC (Hidden Virtual Network Computing) functionality.SectopRATA malvertising campaign on Bing is using a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to spread SectopRAT malware.
Vendors
Products
BingA malvertising campaign on Bing is using a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to spread SectopRAT malware.ClaudeA malvertising campaign on Bing is using a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to spread SectopRAT malware.DiscordThe malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products.SteamThe malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products.TelegramThe malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products.