Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

AI & Machine LearningInfrastructure & Public WorksAI Diagnostics

A sophisticated malvertising campaign has been uncovered, using Claude Desktop to distribute SectopRAT malware to 29 organizations.

TL;DR
• A malvertising campaign used Claude Desktop to distribute SectopRAT malware to 29 organizations.
• The attackers used Claude to host the malicious loader and EtherHiding to store command-and-control information.
• The malware was distributed through a fake Claude Desktop download page.

Summary
The July 2026 malvertising campaign, dubbed FakeAgent, leveraged a legitimate Claude.ai public artifact to deliver a malicious ClaudeDesktop.exe that installed SectopRAT across 29 organizations. The attack exploited SEO poisoning, DLL sideloading, and Ethereum‑based command‑and‑control, demonstrating advanced anti‑analysis techniques and the growing intersection of AI platforms with cyber threats.
• Verify top‑level domains before downloading software.
• Monitor search engine ads for anomalous links.
• Employ AI‑assisted reverse engineering for obfuscated payloads.
• Track blockchain transactions to uncover hidden C2 infrastructure.
• Share decrypted indicators under open licenses to aid community defense.

The initial access vector involved a Bing search for "Claude Desktop App," where a sponsored link redirected users to a Claude.ai public artifact. This artifact, falsely presented as a legitimate download page, forwarded users to an attacker‑controlled domain that served a disguised ClaudeDesktop.exe. The executable, masquerading as a JetBrains Chromium Embedded Framework helper, contained a tampered libcef.dll that staged the real payload.

Analysis revealed the use of VMProtect to obfuscate the DLL and an Ethereum contract (0xc1907d7be91f95903ad66d775c397302e7dd9228) to store encrypted command‑and‑control data. The malware also employed GPU‑based anti‑VM checks via a custom DirectX shader, making traditional CPU‑based decryption ineffective. By reconstructing the shader’s AES‑256‑CTR routine with a corrected key byte, analysts decrypted the payload and exposed a .NET assembly that matched SectopRAT signatures.

Operational security failures were traced to a single email address that registered multiple malicious domains, including download‑app.us and polse.us, the latter seized by Microsoft’s Operation Endgame. Blockchain analysis linked the campaign to BSC transactions dating back to May 2025, revealing a long‑standing, rotating C2 infrastructure. The final C2 IP, 2.24.131.246, was identified in June 2026, confirming the persistence of the threat.

Conclusions emphasize the need for cautious domain validation, vigilant ad monitoring, and the strategic use of AI tools for rapid deobfuscation. The incident illustrates how AI platforms can become both vectors for malware distribution and powerful allies for defenders, underscoring the importance of shared intelligence and open‑source collaboration in mitigating evolving cyber risks.

The use of AI-powered tools like Claude in malicious campaigns highlights the need for increased vigilance and awareness in the cybersecurity community.