--- title: FakeAgent Campaign: Malicious Claude Artifact Used to... description: Huntress researchers disclosed the FakeAgent campaign, a malvertising operation that abused a public Claude Artifact hosted on Anthropic's claude.ai domain to... canonical: https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations | daily.dev og:description: Huntress researchers disclosed the FakeAgent campaign, a malvertising operation that abused a public Claude Artifact hosted on Anthropic's claude.ai domain to... og:url: https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn og:image: https://api.daily.dev/og/posts/MNGqikySN.png og:image:alt: FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 3 min read · 0 upvotes · 0 comments ## Summary Huntress researchers disclosed the FakeAgent campaign, a malvertising operation that abused a public Claude Artifact hosted on Anthropic's claude.ai domain to distribute SectopRAT, compromising at least 29 organisations over two days in July 2026. Victims searching for the Claude Desktop app on Bing were served a sponsored ad pointing to a spoofed artifact that mimicked the official installer. The malicious executable used DLL sideloading via a repurposed JetBrains binary, VMProtect packing, and a GPU-based anti-VM check. Uniquely, the payload was decrypted using a custom DirectX shader, and command-and-control infrastructure was hidden inside Ethereum blockchain transactions via the EtherHiding technique. Huntress linked the operator to at least ten other domains and a prior fake Docker Desktop campaign. The incident highlights a growing trend of attackers targeting AI platform infrastructure rather than relying on typosquatted domains. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://daily.dev/posts/inside-fakeagent-how-a-claude-desktop-malvertising-campaign-hit-29-organizations-with-sectoprat-ihal6pypn) · Huntress Blog · 0 upvotes · 0 comments - [How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface](https://daily.dev/posts/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface-oxjgyttbh) · BleepingComputer · 0 upvotes · 0 comments - [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign](https://daily.dev/posts/threat-actors-abuse-claude-ai-shared-chat-for-clickfix-malvertising-campaign-zdoc6dupj) · Trend Micro · 1 upvotes · 0 comments - [The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms](https://daily.dev/posts/the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms-clbkcskrj) · Huntress Blog · 1 upvotes · 0 comments --- Tags: [#cyber](https://daily.dev/tags/cyber), [#malware](https://daily.dev/tags/malware), [#claude](https://daily.dev/tags/claude) [View this post on daily.dev](https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations","url":"https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn"},"datePublished":"2026-07-23T10:54:38.644Z","dateModified":"2026-07-23T23:42:13.406Z","description":"Huntress researchers disclosed the FakeAgent campaign, a malvertising operation that abused a public Claude Artifact hosted on Anthropic's claude.ai domain to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d688ba91d06a1381e73ffa611797c2cb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d688ba91d06a1381e73ffa611797c2cb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations-mngqikysn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,malware,claude","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations"}]} ```