1. Basic Information Original Title: How threat actors are turning trusted AI platforms into an attack surface Source: BleepingComputer, Huntress Publication Date: 2026-09-11 Severity: High Basis for Severity: Trusted AI sharing pages are being used to distribute malware via ads and SEO, and infections have been confirmed across multiple organizations. This technique abuses the trust placed in public pages. Original Article: How threat actors are turning trusted AI platforms into an attack surface Related Sources: Huntress: FakeAgent malvertising, Huntress: MacSync stealer and RAT, Huntress: What is AI poisoning?, Huntress: AMOS AI sharing chat abuse, MITRE ATT&CK: Malicious Copy and Paste Related Malware: FakeAgent, SectopRAT, MacSync, AMOS Related Products: Claude Artifacts, Claude Share, ChatGPT shared conversations, Grok shared conversations, macOS, Windows 2. Executive Summary Threat actors use Claude Artifacts/Share and ChatGPT/Grok shared pages to direct users to execute fake apps or paste commands into the Terminal. FakeAgent delivering SectopRAT, MacSync, and AMOS represent distinct attack scenarios. 3. Attack Flow Flow 1: FakeAgent: Delivering SectopRAT to Windows Sponsored ads on Bing direct users to a legitimate Claude Artifact. A download link inside the Claude Artifact directs users to an external fake Claude Desktop distribution site. The user executes ClaudeDesktop.exe. The malware launches SectopRAT through DLL side-loading using a signed helper, scheduled tasks, virtual environment detection, and EtherHiding. SectopRAT provides remote access capabilities. Flow 2: MacSync: macOS Infection via Claude Shared Conversations Sponsored ads on Google direct users to fake Apple Support instructions on Claude Share. The user opens the Terminal, pastes the provided curl command, and executes it. A six-stage framework deploys a loader, an information-stealing feature via AppleScript, and a Mach-O format RAT. The malware collects browser cookies and credentials, the Keychain, SSH and cloud authentication keys, and wallet-related data. It also uses a signed helper to obtain screen recording permissions and a modified wallet app to steal recovery phrases. Flow 3: AMOS: Fake Disk Cleanup Instructions on ChatGPT and Grok Shared ChatGPT and Grok conversations appearing in search results mimic instructions to free up macOS disk space. The user pastes and executes a command in the Terminal to retrieve a loader. Credentials obtained through a fake password prompt are verified and used for privilege escalation and data theft. AMOS collects and exfiltrates browser, Keychain, and wallet data, and replaces certain wallet applications with modified versions. A LaunchDaemon and monitoring script restart the info-stealer to maintain persistence. 4. Attacker Position and Execution Location External threat actors direct users via ads, search results, and public AI sharing pages. Once executed, the RAT/info-stealing malware runs on the victim endpoint to access credentials and wallets. 5. Victim and Administrator Perspective Victims Pages disguised as Claude Desktop, Apple Support, or macOS disk cleanup, along with requests to paste commands into the Terminal. Fake applications and unexpected requests for Full Disk Access or screen recording. Administrators Terminal and shell execution triggered by user actions, suspicious curl traffic, unknown executables, DLL side-loading, and scheduled tasks. The parent of the shell is not necessarily the browser. New external domains visited immediately after accessing legitimate AI domains, along with data access to wallets, Keychains, and browsers. 6. Success and Failure Conditions Success Conditions Users trust the ad/SEO results and the legitimate AI sharing pages. Users execute external downloads or shell commands via the clipboard. Application control or EDR does not block multi-stage loaders, side-loading, or credential access. Failure Conditions Inference: Inspecting redirects and downloads from sharing pages, and blocking them if identified as malicious. Inference: Controlling unauthorized script execution on the endpoint and addressing pathways where users paste commands from sharing pages. Restricting only browser child processes does not prevent this entire pathway. Inference: Blocking unauthorized DLL loading, persistence, and credential access via application control or EDR limits subsequent damage. 7. What Happens Upon Success RAT infection and remote control of Windows/macOS endpoints. Theft of browser cookies and credentials, Keychains, SSH and cloud authentication keys, and wallet-related information. Inference: If stolen sessions or keys are valid, this can lead to unauthorized access to SaaS and cloud environments or cryptocurrency theft. 8. Observable Logs Email None. The primary vector is search ads and SEO. Proxy / SWG / DNS Inference: Transitions from legitimate AI sharing URLs to newly registered or lookalike download domains, payload traffic, C2, and blockchain RPC traffic. Endpoint / EDR Inference: Depending on the scope of EDR collection, logs may show user-initiated shells, curl commands, DLL loading, scheduled tasks, and access to credential files. Direct parent-child relationships between browsers and shells are not assumed. Identity / IdP Inference: Use of stolen cookies, cloud auth keys, or SSH keys from unknown sources. SaaS / Cloud Inference: If stolen tokens are abused, review SaaS and cloud operation logs to identify the source and targets. Investigate AI sharing page browsing paths using available browser history or proxy logs. Network Inference: C2 traffic for SectopRAT, MacSync, and AMOS, referencing contracts used in EtherHiding, and unusual bulk exfiltration of credentials. 9. Attack Success Determination Below are ranges confirmed by public information and criteria used for internal investigations. User Action Confirmed: Public Info: Huntress reports user execution of commands in the fake Claude Desktop execution, as well as the MacSync and AMOS cases. Do not treat three separate cases as consecutive actions by a single victim. Malware Execution or Authentication Success Confirmed: Public Info: SectopRAT infection via FakeAgent, MacSync info-stealer features and RAT, and AMOS execution and persistence are reported respectively. Data Theft or Session Compromise Confirmed: Public Info: Huntress reports information theft and analyzes the collection targets of each malware. This does not mean all sensitive data was stolen from every victim endpoint. Subsequent Compromise Confirmed: Criteria: Confirmed when unauthorized use of stolen sessions or auth keys, or unauthorized fund transfers are identified. Public sources do not determine the full scope of these successes. 10. Investigation Playbook Triggers External downloads after visiting AI sharing pages, user execution of suspicious shell commands, or execution of unknown applications. Initial Triage Preserve search terms, ads, AI sharing URLs, redirect chains, hashes of downloaded files, and executed commands. Endpoints and Servers For Windows, check for DLL side-loading, scheduled tasks, and RATs. For macOS, check shell history, quarantine attributes, LaunchAgents/LaunchDaemons, AppleScript, TCC, and modified wallet apps. Authentication and Cloud Check browser sessions, SSH/cloud auth keys, Telegram, wallets, and IdPs for usage from unknown sources and token creation. Subsequent Actions Check for reuse of stolen cookies, cloud API enumeration, wallet transfers, and additional RATs or remote management tools. Containment Isolate the endpoint to preserve evidence, and revoke browser and IdP sessions as well as exposed tokens. Reissue SSH and cloud auth keys, and if wallet recovery information is exposed, consider migrating assets to a new wallet created on a secure device. Add malicious sharing URLs, redirect domains, and hashes to organizational blocklists. Judgment Categories Distinguish between page views, user execution, loader success, RAT/info-stealer C2, sensitive data theft, and subsequent abuse. 11. Defense and Detection Ideas Single Events Inference: Treat suspicious download and execution commands run by users in the Terminal, PowerShell, or cmd as detection candidates. Do not require them to be child processes of the browser. Inference: Monitor signed helpers loading unknown DLLs from the same directory, taking file provenance into account. Time-Series Correlation Inference: Correlate search ads, AI sharing pages, access to external destinations, and subsequent shell execution, credential access, and C2 traffic for the same endpoint and user over time. Threat Hunting Inference: Cross-search for commands executed before and after viewing AI sharing URLs, downloads, DNS activity, and credential access. 30 minutes is an initial search window example; expand this based on execution delays or log retention periods. Log Gaps Lack of full URLs, redirects, clipboard data, process parent-child relationships, or TCC history may make it difficult to separate legitimate AI usage from attack paths. Priority Mitigations Inference: Prioritize correlating page views with manual shell execution, application control, inspecting external redirect destinations, and credential revocation procedures. 12. Facts / Inference / Hypothesis Facts In the FakeAgent campaign, sponsored Bing ads directed users to a legitimate Claude Artifact, which led to a fake Claude Desktop distribution domain that deployed SectopRAT. Huntress confirmed activity across at least 29 organizations. FakeAgent combined DLL side-loading using a signed jcef_helper.exe and a modified libcef.dll, scheduled tasks named DockerDesktop.exe, VMProtect, GPU-based virtual environment detection, and EtherHiding using BSC smart contracts. In the MacSync campaign, Google sponsored ads directed users to fake Apple Support instructions on claude.ai/share, prompting them to run Terminal commands containing curl, which deployed a six-stage loader, an AppleScript info-stealer, and a Mach-O RAT. Huntress reported that MacSync collects browser cookies and credentials, Keychains, Telegram data, SSH and cloud auth keys, and wallet-related info, while also using a signed helper for screen recording permissions. Huntress reported a December 2025 AMOS case where ChatGPT and Grok shared conversations appearing in search results disguised themselves as disk cleanup instructions to trick users into pasting and executing commands. Public information does not indicate infrastructure compromise of AI vendors; trust in legitimate hosts and brands was abused. Inference Relying solely on URL reputation data that permits claude.ai broadly may overlook malicious content hosted on legitimate sites and external redirects. Search ads, AI sharing pages, the clipboard, and script execution must be correlated as a single path. Hypothesis No additional hypotheses. Unverified items are listed under 'Unknowns and Further Investigation'. 13. MITRE ATT&CK Mapping T1189 Drive-by Compromise (Confidence: high): Directing users from ads and SEO results to legitimate AI sharing pages and malicious sites. T1204.002 User Execution: Malicious File (Confidence: high): In FakeAgent, users execute an installer distributed as a fake Claude Desktop. T1204.004 User Execution: Malicious Copy and Paste (Confidence: high): In MacSync and AMOS distribution paths, users are tricked into pasting and executing commands in the Terminal. T1574.002 Hijack Execution Flow: DLL Side-Loading (Confidence: high): FakeAgent combines a signed helper with a modified libcef.dll. T1053.005 Scheduled Task/Job: Scheduled Task (Confidence: high): Creates a scheduled task disguised as DockerDesktop.exe on Windows. T1555.003 Credentials from Password Stores: Credentials from Web Browsers (Confidence: high): MacSync and AMOS collect browser cookies and credentials. 14. Unknowns and Further Investigation A complete list of malicious Claude Artifact/Share and ChatGPT/Grok shared URLs. Attribution of ad accounts and campaign operators. Lifespan and evolution of all C2 servers, contracts, and payload hashes for FakeAgent. It remains unverified whether multiple campaign operators are the same or if they automate the creation of AI sharing pages. 15. Impact on SOCs and Organizations For organizations where users can view AI sharing pages during business hours, verify not only whether the domain is legitimate, but also subsequent external downloads or user-executed commands. Because manually opened Terminals do not always run as child processes of the browser, it is useful to correlate the activities of the same endpoint and user across a timeline. 16. Summary by Role SOC: Correlate search ads -> AI sharing pages -> external domains -> downloads/Terminal execution -> credential access in chronological order. Administrators: Avoid blanket permissions for AI sharing pages and implement application allowlisting, script execution controls, and correlation monitoring between browser browsing and shell execution. Users: Do not blindly execute downloads or Terminal commands suggested by search ads or AI responses; verify official distribution sources and administrative procedures.