Huntress documented a malvertising campaign dubbed FakeAgent that hit 29 organizations between July 21-22, 2026, after victims searched for the Claude Desktop app on Bing and clicked a sponsored ad linking to a malicious public Claude Artifact hosted on the legitimate claude.ai domain. The fake download page redirected victims to attacker-controlled domains serving a trojanized ClaudeDesktop.exe that used DLL sideloading (via a tampered libcef.dll alongside a legitimate JetBrains jcef_helper.exe) to deploy SectopRAT, a .NET-based remote access trojan that steals credentials, credit card data, and files. The malware used VMProtect packing, GPU-based anti-VM checks, and a DirectX shader-based decryption routine to evade analysis, and stored command-and-control rotation data on the Ethereum blockchain (EtherHiding) via BSC transactions. Huntress used Claude Opus to help reimplement the AES-256-CTR decryption and SM5 shader emulation, eventually recovering the live C2 address 2.24.131.246. OSINT pivoting tied the operator to prior campaigns including a fake Docker Desktop distribution and a domain previously seized by Microsoft's Operation Endgame. The malicious artifact had 7,100 views before Anthropic removed it.
Questions this post answers
What is the FakeAgent malvertising campaign that used Claude Desktop as a lure?
FakeAgent is a malvertising campaign that hit 29 organizations between July 21 and 22, 2026, where victims searching Bing for the Claude desktop app clicked a sponsored ad leading to a malicious public Claude Artifact hosted on the legitimate claude.ai domain. Clicking download redirected victims to claude.ai.download-app[.]us, serving a trojanized ClaudeDesktop.exe that ultimately installed SectopRAT, a credential and financial data-stealing RAT. Security teams tracking emerging malvertising tactics like this can follow threat writeups on daily.dev.
How did attackers hide command-and-control infrastructure in the SectopRAT campaign?
Attackers stored command-and-control rotation data in Ethereum Binance Smart Chain (BSC) transactions, a technique called EtherHiding, referencing a contract address with no cryptocurrency balance whose function calls resolved to an encrypted payload location. This let the operator rotate C2 servers simply by posting new blockchain transactions, making takedown far harder than with traditional domain-based infrastructure. Anyone researching blockchain-based C2 evasion can dig into detailed incident breakdowns like this on daily.dev.
How was Claude AI used to help reverse-engineer the SectopRAT malware's shader-based decryption?
Claude Opus assisted analysts in reimplementing an SM5 bytecode interpreter to emulate a malicious DirectX shader that performed AES-256-CTR decryption with a modified MixColumns function, since the malware delegated decryption to the GPU to evade standard reverse-engineering tools. Claude helped recover the AES S-box, Rcon sequence, and key material, though a manually transcribed one-byte key error initially blocked successful decryption until humans caught it. Developers curious how LLMs assist in security reverse-engineering can find similar deep dives on daily.dev.