Overview

On July 21-22, 2026, Huntress' Security Operations Center identified a burst of unusual executable installs, Microsoft Defender exclusions, and anomalous persistence activity across 29 separate organizations, all traced back to a single process name: ClaudeDesktop.exe. Huntress has named the campaign FakeAgent, and the investigation that followed is one of the more unusual malvertising cases of the year, both for its abuse of legitimate infrastructure and for the anti-analysis lengths the operator went to protect the payload.

The short version: a Bing search ad for "Claude Desktop app" pointed, legitimately, to claude.ai. But the ad's destination was a user-generated Claude Artifact, a feature that lets anyone publish and share simple interactive content on Anthropic's own domain. The artifact impersonated the official Claude Desktop download page and redirected victims off-domain to attacker infrastructure serving a trojanized installer. What followed was a Matryoshka-doll chain of DLL sideloading, VMProtect obfuscation, GPU-based anti-VM checks, and a Command-and-control scheme hidden inside Ethereum blockchain transactions, all in service of deploying SectopRAT, a .NET remote access trojan built to steal credit card data, personal information, files, and passwords.

Before Anthropic removed it, the malicious artifact had accumulated 7,100 page views..

Background: Why AI Tool Downloads Are a Growing Target

Malvertising and SEO poisoning against searches for legitimate software are not new; Huntress and others have documented years of fake installers for browsers, utilities, and enterprise tools served through paid search results. What's new here is the target: as AI assistant adoption has surged, searches for "Claude Desktop app," "ChatGPT download," and similar terms have become high-value real estate for attackers, precisely because users searching for AI tools are often less cautious about installer provenance than they might be for, say, a VPN client or a "free" utility.

The FakeAgent campaign goes a step further than typical typosquatting or lookalike-domain malvertising: it abused a legitimate, first-party feature (Claude Artifacts, user-generated shareable content hosted on claude.ai itself) to host the initial lure. Because the redirect chain started on a domain the victim actually searched for and trusted, the usual heuristic of "check the URL bar" would not have saved most victims at the first step: the compromise only becomes visible once the artifact's "Download" button hands off to attacker-controlled infrastructure.

Huntress separately notes this is "becoming strikingly common" and references a related prior writeup on fake Claude malware downloads, suggesting this operator (or others copying the technique) will likely continue targeting AI-tool search traffic.

Attack Chain

Stage 1: Initial Access: Malvertising Through a Trusted Domain

A victim searches Bing for "CLAUDE DESKTOP APP." Among the sponsored results is a link that, unlike the surrounding fake-installer ads, points to the legitimate claude.ai domain, specifically to a public artifact at claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877. The artifact page visually mimics a Claude Desktop/Cowork download page, carrying only Claude's standard platform disclaimer that "Content is user-generated and unverified."

Clicking the artifact's Download button redirects the victim off-platform, first to claude.ai.download-app[.]us (a typosquat-style domain registered May 9, 2026, note the real claude.ai substring embedded to pass a casual glance), then to downloading-api.it[.]com/html/claude/win, which finally serves the malicious installer as ClaudeDesktop.exe.

Huntress reported the malicious artifact to Anthropic; it was removed as of the July 22 publication date, but not before accumulating 7,100 views.

Stage 2: The Trojan Horse: A Legitimate Binary, Not a Fake One

Here is the campaign's first notable design choice: ClaudeDesktop.exe is not actually a Claude binary at all. It is a component of JetBrains' jcef_helper.exe, a legitimate, signed Chromium Embedded Framework (CEF) application, simply renamed. This executable is vulnerable to DLL sideloading: a technique where a maliciously modified DLL, placed in the application's search path, gets loaded and executed by the trusted, signed parent process instead of (or alongside) its legitimate counterpart.

The attacker plants a tampered libcef.dll next to the renamed binary, a filename that legitimately ships with any Chromium Embedded Framework application, so its mere presence isn't inherently suspicious. The hash of this particular copy does not match public records, confirming tampering.

A near-identical pairing, DockerDesktop.exe, is written to disk as a persistence mechanism via scheduled task, ensuring reinfection if the primary payload is removed.

Stage 3: First Layer of Obfuscation: VMProtect and EtherHiding

Examining the sideloaded libcef.dll, Huntress found it packed with VMProtect, a commercial software-protection tool frequently abused by malware authors specifically because it makes reverse engineering dramatically more time- and resource-intensive.

Buried inside is a reference to an Ethereum smart contract (0xc1907d7be91f95903ad66d775c397302e7dd9228). This is an instance of EtherHiding: the same C2-resilience technique documented in North Korean UNC5342 campaigns and widespread ClearFake/fake-update malware. The contract itself holds no cryptocurrency balance; its purpose is purely to store and serve command-and-control instructions. Because blockchain transactions are effectively impossible to take down and trivial for an attacker to update, EtherHiding gives the operator a highly resilient way to rotate C2 addressing without needing to stand up new, seizable infrastructure. Calling the contract yields an encrypted response that Huntress could not decrypt before the binary entered its VMProtect-obfuscated section, a dead end that pushed the investigation toward the campaign's second payload.

Stage 4: Second Payload, Second Sideload: GPU-Based Anti-Analysis

A second persistence artifact was found written to %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe, again a legitimate, signed binary, this time from IBM SPSS (a statistical analysis platform), again abused via DLL sideloading, this time via a companion tempdir.dll.

tempdir.dll is where the campaign's anti-analysis engineering peaks. It implements a GPU-based anti-VM gate: before executing anything, it enumerates the system's DirectX Graphics Interface (DXGI) adapters, checking for known virtualization vendor IDs (0x1234 for QEMU, 0x15AD for VMware, and others) and for suspiciously low VRAM allocation (under 1GB), both strong signals of a sandbox or analysis VM rather than a genuine victim machine. It also runs a small compute-shader timing check; if the shader executes implausibly fast (as can happen under emulation), the malware aborts.

More unusually, the malware's actual payload decryption routine is not CPU-based at all: it is a compiled DirectX shader executed on the GPU itself. Standard analyst workflows (hook the crypto API calls, dump decrypted memory) don't apply here, because there is no conventional crypto API call to hook; the decryption logic lives inside GPU shader bytecode that standard reverse-engineering tooling doesn't decompile.

Huntress ultimately extracted the DirectX Binary Container (DXBC), found a Rijndael S-box and key material embedded in the shader, and determined the algorithm was a modified AES-256-CTR with a non-standard MixColumns operation in the shader's Row 3 step, a deliberate deviation from standard AES specifically intended to break naive reimplementations. With AI-assisted analysis (Claude Opus 4.8 was used to help reimplement an SM5 bytecode interpreter and reason through the modified cipher), Huntress recovered the correct key and nonce and statically decrypted the payload without needing GPU execution at all.

Stage 5: The Payload: SectopRAT

Decrypting appcfg.dat yielded both a standard PE file and a heavily obfuscated .NET assembly. Decompilation (via ILSpy) surfaced plaintext strings referencing browser logins, cookies, autofill data, credit card fields, Chromium key theft, FTP credentials, and Discord/messaging-client targeting, consistent with SectopRAT, a known .NET remote access trojan and infostealer family, or an unremarkable fork of it. Huntress later updated its attribution specifically to SectopRAT after identifying HVNC (Hidden VNC) capability in the .NET payload during closer analysis of the Ethereum-BSC-sourced C2 configuration.

The command-and-control mechanism follows the same EtherHiding pattern as the first-stage loader: the .NET payload also queries Ethereum/BNB Smart Chain transactions for its live C2 address. At time of Huntress' analysis, the current C2 was 2.24.131[.]246.

Timeline

Infrastructure and Operator Attribution

Huntress pivoted from the download-app[.]us domain registration record through WHOIS and the Validin intelligence platform to identify the registrant email address before the hosting provider redacted personal details. That email address indexes back to 10 distinct domains registered since December 2025, extending the operator's known infrastructure well beyond this single campaign.

Notably, at least one domain registered to the same email, polse[.]us, was previously seized by Microsoft as part of Operation Endgame, a joint international law-enforcement effort to disrupt malware distribution and C2 infrastructure; Microsoft had identified polse[.]us as hosting StealC stealer malware. This places the FakeAgent operator within the same infrastructure ecosystem as StealC distribution, though it is not confirmation of shared operatorship beyond domain-registration overlap.

Huntress also triangulated the same operator to an internally tracked campaign from April 2026 that used Docker Hub to distribute a fake Docker Desktop installer, using the identical libcef.dll sideloading vector under the guise of a trusted Docker download. By decrypting the operator's historical Ethereum BSC transaction history (now possible with the recovered cryptomaterial), Huntress traced C2 infrastructure changes back to an initial transaction on 2025-05-30: indicating this operator's EtherHiding-based infrastructure has been active for well over a year, likely across campaigns beyond the two Huntress has directly attributed.

Indicators of Compromise

Network: Domains and URLs

Network: IP Addresses

Blockchain

File Hashes (SHA-256)

Host Artifacts

MITRE ATT&CK Mapping

Key Takeaways

A trusted domain is only as trustworthy as its user-generated content policy. The initial redirect in this campaign lived on claude.ai itself, via a legitimate public-artifact feature. Any platform that allows user-generated, publicly shareable content (AI chat tools very much included) is a potential first-hop for malvertising that inherits the platform's own domain trust. Web-filtering and DNS-security tooling that allowlists entire trusted domains rather than evaluating specific paths/content will miss this class of abuse.

Signed binaries plus DLL sideloading remains devastatingly effective. Every executable a victim or an EDR product would inspect in this chain (jcef_helper.exe renamed as ClaudeDesktop.exe, and a genuine IBM SPSS binary renamed as sslconf.exe) is legitimately signed. The actual malice lives entirely in co-located DLLs. Hash/signature-based allowlisting of "known good" vendors is not sufficient defense against this technique; sideload-path and DLL-provenance monitoring is required.

Anti-analysis investment has scaled up. VMProtect packing, EtherHiding C2 resilience, and GPU-shader-based payload decryption represent a meaningfully higher investment in evading both automated sandboxes and human reverse engineers than is typical for commodity RAT delivery. Expect this tooling, or forks of it, to reappear in other campaigns from the same or copycat operators.

AI-assisted reverse engineering cuts both ways. Huntress' own writeup is notably transparent that Claude Opus 4.8 materially assisted their analysis of the GPU-shader decryption routine, including catching a human transcription error in the recovered AES key. As attackers adopt AI-accelerated tooling for obfuscation and evasion, defenders adopting AI-assisted analysis workflows is a legitimate and apparently effective countermeasure, worth factoring into tooling and training decisions going forward.

References

1. Tigges, M. (2026, July 22). Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT. Huntress. https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat

2. Bleeping Computer. (2026, July). Fake Claude App Promoted by Bing Ads Pushes SectopRAT Malware. https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/

3. IT Security Guru. (2026, July 23). FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations. https://www.itsecurityguru.org/2026/07/23/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations/

4. Help Net Security. (2026, July 23). How Attackers Hosted a Fake Claude Download Page on the claude.ai Domain. https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/

5. Microsoft. (2026, June 24). StealC and Amadey: Breaking Down Infostealers and the Cybercrime Services That Deliver Them. https://www.microsoft.com/en-us/security/blog/2026/06/24/stealc-and-amadey-breaking-down-infostealers-and-the-cybercrime-services-that-deliver-them/

6. Operation Endgame. (2026). https://operation-endgame.com/

7. Google Cloud / Mandiant Threat Intelligence. DPRK Adopts EtherHiding. https://cloud.google.com/blog/topics/threat-intelligence/dprk-adopts-etherhiding (referenced for EtherHiding technique background)

8. Internal: 2026-07-24 Morning Threat Intelligence Brief, Daily Briefs folder.