FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations

Huntress researchers disclosed the FakeAgent campaign, a malvertising operation that abused a public Claude Artifact hosted on Anthropic's claude.ai domain to distribute SectopRAT, compromising at least 29 organisations over two days in July 2026. Victims searching for the Claude Desktop app on Bing were served a sponsored ad pointing to a spoofed artifact that mimicked the official installer. The malicious executable used DLL sideloading via a repurposed JetBrains binary, VMProtect packing, and a GPU-based anti-VM check. Uniquely, the payload was decrypted using a custom DirectX shader, and command-and-control infrastructure was hidden inside Ethereum blockchain transactions via the EtherHiding technique. Huntress linked the operator to at least ten other domains and a prior fake Docker Desktop campaign. The incident highlights a growing trend of attackers targeting AI platform infrastructure rather than relying on typosquatted domains.

Source: https://www.itsecurityguru.org/2026/07/23/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations. 8sync News only summarizes and links out; content copyright belongs to the authors and original sources.