Overview
On September 11, 2026, the Huntress SOC released a set of cases tracked over a nine-month period. The conclusion ran counter to their own expectations: what is currently being exploited more frequently in the AI domain is not the models or the AI companies themselves, but rather the everyday AI features that users rely on.
Attackers accomplished this by chaining three components together: publicly shareable AI content, open lightweight applications, and paid search engine ad placements. In July 2026, employees across more than 29 organizations clicked on a Bing sponsored ad while searching for the Claude desktop client. The landing page was a fraudulent download page hosted directly on the legitimate claude.ai domain, ultimately leading to the deployment of the SectopRAT remote access trojan. After being reported to Anthropic, the artifact was taken down by July 22, by which time the page had already accumulated 7,100 views; campaigns utilizing the same batch of redirect domains continued into August.
Two additional attack vectors occurred on macOS: one used claude.ai/share to impersonate installation instructions from Apple Support to deliver the MacSync stealer; another turned shared conversations on ChatGPT and Grok into SEO-poisoned pages to deliver AMOS. None of these three attack vectors breached the security mechanisms of the AI platforms themselves; instead, they exploited users’ trust in familiar brands and legitimate domains.
Attack Background: Three Abused AI Features
The term “trusted AI platforms” used in this article refers to mainstream AI services that users regularly interact with and implicitly trust for official content—such as Claude, ChatGPT, and Grok. Here, “trusted” describes user trust rather than the platform’s security rating or governance certification.
- Claude Artifacts: Renders code, documents, diagrams, and full web pages in a dedicated side panel next to the chat window rather than outputting them as plain text. Users can publish an Artifact as a public link with one click, accessible to anyone without requiring a Claude account. Designed for lightweight demonstration scenarios, Anthropic handles these pages with a single line at the top stating “Content is user-generated and unverified,” without additional moderation.
- claude.ai/share: Generates shareable URLs when publishing a Claude chat conversation. Once posted to crawlable locations like forums or social media platforms, these links get indexed by search engines. The platform does not verify whether the page content serves as an installation guide.
- Shared Conversations on ChatGPT & Grok: Operates under the same logic. Public conversations hosted on chatgpt.com and grok.com can be indexed and rank highly for troubleshooting keywords such as “clear disk space on macOS”.
All three features reside within the platform’s trust boundary. Users recognize the brand and domain, making malicious instructions appear legitimate within this context. While these campaigns are typically taken down by platforms within hours to days, that window is more than sufficient for attackers.
Attack Principles and Workflows
1. Prerequisites
For the chain to succeed, three conditions must be met simultaneously: the platform permits users to generate content and publish it as public, indexable pages with one click; search engines are willing to rank these pages or ads leading to them at the top; and users are accustomed to treating “the first search result plus a command pasted into the terminal” as standard operating procedure. Between 2025 and 2026, these three conditions coincided, marking the line between this wave of attacks and traditional phishing campaigns.
2. Execution Pathways
Pathway 1: FakeAgent (Windows, July 2026, 29+ Organizations)
Attackers first publish a malicious Claude Artifact styled to mimic a completely legitimate download page for Claude Desktop / Claude Cowork. When employees search for the Claude desktop version, they click a Bing sponsored ad pointing to the genuine claude.ai domain, landing directly on this Artifact—where the legitimate domain provides the final missing piece of the deception.
Figure 1: Phishing page for Claude Desktop / Cowork hosted on Claude Artifacts (Source: How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface)
Upon clicking “Download,” the victim is routed through external domains: starting at claude.ai.download-app[.]us and proceeding to downloading-api.it[.]com/html/claude/win. The downloaded archive contains a renamed yet validly signed JetBrains binary (vulnerable to DLL side-loading), a tampered libcef.dll, and DockerDesktop.exe. DockerDesktop.exe is written to disk and registered as a scheduled task to ensure persistent re-infection. The final payload is SectopRAT, a .NET remote access trojan capable of exfiltrating credit card data, personal information, files, and passwords.
Pathway 2: Fake Installation Guides via claude.ai/share (macOS)
A victim searches for “Claude on Mac” and clicks a sponsored result leading to a claude.ai/share link disguised as an installation guide from Apple Support, labeled on-page as “Shared by Apple Support”. The guide instructs the user to paste a curl command into the Terminal, triggering a six-stage chain that ultimately deploys the MacSync stealer to harvest cookies, account credentials, Keychain secrets, Telegram sessions, as well as SSH and cloud service keys.
Figure 2: A claude.ai shared conversation disguised as “Shared by Apple Support,” step-by-step guiding victims to paste a single-line curl command into Terminal (Source: How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface)
Because the page is hosted on Anthropic’s own domain, there are no spoofed URLs or certificate warnings, causing all traditional visual indicators users rely on to detect phishing to fail.
Pathway 3: ChatGPT / Grok Conversation Poisoning (macOS, December 2025)
The third pattern directly targets AI-generated troubleshooting suggestions. A standard search for “clear disk space on macOS” presented victims with top-ranked ChatGPT and Grok shared conversations containing ClickFix-style commands instead of real solutions. These conversations were created by attackers, published to generate public URLs under platform domains, and pushed to top Google results via SEO poisoning. Seeing that the links resided legitimately on chatgpt.com and grok.com, victims executed the terminal commands, resulting in the delivery of the AMOS stealer.
Figure 3: Search results and high-rated links pushed to top Google results via SEO poisoning (Source: How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface)
Attribution and Root Cause Analysis
During analysis, Huntress observed multi-layered protection on the payload. They ultimately leveraged Claude to complete the reverse engineering, uncover the command-and-control (C2) addresses, and correlate them with previous malware distribution campaigns. WHOIS records and the Validin intelligence platform linked the registration email of download-app[.]us to ten domains dating back to December 2025; one of these, polse[.]us, was seized by Microsoft under Operation Endgame.
The underlying issue is not a single technical flaw. The platform’s publishing mechanisms aim to make demo sharing seamless, search engines strive to rank relevant results higher, and users habitually trust top results—when these three individually reasonable assumptions overlap, they create an unmonitored path where no single party is responsible for verification. The only element distinguishing real from fake is a fine-print disclaimer rendered in a font size so small it goes virtually unnoticed.
Threat and Consequence Assessment
None of the three incidents breached the security controls of the AI platforms. Attackers leveraged user trust in familiar brands and genuine domains, rendering domain blacklists and certificate validations ineffective in these scenarios.
The damage extends beyond individual endpoints. The impact on 29 organizations within two days demonstrates that this vector is exceptionally effective in enterprise environments where multiple users search for the same software name around the same time. MacSync targets keychains and cloud service credentials, while AMOS targets macOS user credentials—both escalating damage from local devices to cloud assets. SectopRAT maintains persistence via scheduled tasks, causing recurring infections if not thoroughly remediated while leaving open a foothold for lateral movement.
Although these campaigns are short-lived—with content usually taken down by platforms within hours to days—the cost of execution is extremely low, and a single successful Artifact publication can reach thousands of potential targets.
Key Takeaways
- For Users: Avoid relying on search engine results for software downloads; use official channels and verify digital signatures.
- For Defenders: Treat two areas as active attack surfaces:
- Restrict clipboard-triggered script execution and enforce application whitelisting.
- Treat troubleshooting commands obtained from AI chats as untrusted inputs requiring origin verification.
- Monitoring Priorities: Focus on newly added scheduled tasks and modifications to antivirus exclusion lists, as both behaviors were present across all three pathways. Provide targeted training against “copy-paste command into terminal” remediation steps. Given the short lifespan of such malicious content, reporting suspicious links to platform vendors as early as possible helps compress the attack window.
References
[1] BleepingComputer — How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/
[2] Help Net Security — How attackers hosted a fake Claude download page on the claude.ai domain https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/
[3] Huntress — Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
[4] Huntress — Reverse Engineering the Six Stages of MacSync Stealer and RAT https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering
[5] Huntress — What Is AI Poisoning? How Attackers Corrupt AI Responses https://www.huntress.com/generative-ai-guide/what-is-ai-poisoning
[6] Huntress — That “Friendly” Prompt is ClickFix https://www.huntress.com/blog/friendly-prompt-is-clickfix-scam
