DEV Community

Anoymask
Anoymask

Posted on Edited on

FakeAgent, MacSync, AMOS, and PasteSwitch: Malware Distribution Through Trusted Web Services

#security #threatintel

1. Basic Information

Legitimate AI sharing pages have been integrated into malvertising and SEO-driven malware distribution, with infections confirmed across multiple organizations. This technique exploits trust in public pages.

2. Executive Summary

Legitimate AI sharing pages and ads on a compromised official HBO Max Reddit account were abused to lure users into downloading fake applications and executing commands. The HBO Max macOS ad scenario and the PasteSwitch Windows vector identified in related research are handled separately.

3. Attack Flow

The following are distinct delivery and theft vectors. ANY.RUN's aggregate data is also separated into alternative vectors—command execution, fake installers, and fake logins—rather than treating all stages as a single continuous chain.

Vector Source / Technique User Action / Execution Prerequisites Deployed Capabilities / Observation Scope
Vector 1: FakeAgent Bing ads -> Legitimate Claude Artifact -> Fake distribution site Run ClaudeDesktop.exe on Windows DLL sideloading and EtherHiding lead to SectopRAT execution (confirmed in at least 29 organizations)
Vector 2: MacSync (Shared Conversation) Google ads -> Fake Apple Support instructions on claude.ai/share Paste and execute a curl command in macOS Terminal 6-stage loader, AppleScript information stealer, and Mach-O RAT deployed
Vector 3: AMOS Search result ChatGPT/Grok shared conversation (fake disk cleanup instructions) Paste and execute a command in macOS Terminal; enter password on fake screen Collects credentials, Keychain data, and wallet information; replaces some wallet applications with modified versions; persists via a LaunchDaemon
Vector 4: PasteSwitch (HBO Max Ads) Malicious ads (108 total) from the compromised official HBO Max Reddit account Lured from fake HBO Max page to paste a command into macOS Terminal HBO Max distribution stopped at the time of research; investigated infrastructure starting from fake Alfred page commands
Vector 5: PasteSwitch (Related Research) Fake app landing pages and related distribution infrastructure macOS command execution or Windows mshta execution from a separate page macOS chunked PUT transmission of /tmp/osalogging.zip; Windows execution of Amatera via MP3/HTA and AMSI bypass (separate from HBO Max ads)
Vector 6: MacSync (iCloud Calendar) Fake app DMG distribution (separate from shared conversation and copy-paste vectors) Execute the fake app inside the DMG on macOS Certain samples execute public iCloud Calendar event descriptions via zsh; deploys Swift-based infostealer and Objective-C backdoor
Vector 7: Custom GPT "Plus 5.6" Google ads -> Legitimate chatgpt.com Custom GPT -> Google Sites fake CAPTCHA Paste and execute PowerShell command on Windows Retrieves and silently installs MSI from decimal IP; executes RAT in memory via DLL sideloading using Canon/Stardock signed apps
Vector 8: ANY.RUN Aggregate (Command Execution) Fake CLI setup instructions, fake verification screens, shared AI pages, etc. (multiple campaigns) Paste and execute commands such as PowerShell, mshta, or curl Retrieves loaders or MSIs based on vector; deploys infostealers or RATs in individual samples (Vectors 9 and 10 are not required subsequent steps)
Vector 9: ANY.RUN Aggregate (Fake Installer) Fake Claude distribution page -> Trojanized installer on GitHub Execute the downloaded installer (no command pasting required) Registers mseupdate task and launches Edge with --headless and port 9222 to exfiltrate cookies and extension data
Vector 10: ANY.RUN Aggregate (Fake Ad Invitation / BitB) Pages mimicking ad account linking, etc. (includes mailto unsubscribe link) Input credentials into Browser-in-the-Browser fake Google login screen opened via Connect action Transmits entered credentials to operators (malware or installer execution is not required)

Vector 1: FakeAgent: Delivering SectopRAT to Windows

  1. Bing sponsored ads redirect users to a legitimate Claude Artifact.
  2. Download links within the Claude Artifact redirect users to an external fake Claude Desktop distribution site.
  3. The user runs ClaudeDesktop.exe.
  4. DLL sideloading via a signed helper, scheduled tasks, virtual environment detection, and EtherHiding launch SectopRAT.
  5. SectopRAT provides remote administration capabilities.

Vector 2: MacSync: macOS Infection via Claude Shared Conversations

  1. Google sponsored ads redirect users to fake Apple Support instructions on Claude Share.
  2. The user opens Terminal and pastes and executes the instructed curl command.
  3. A 6-stage architecture deploys loaders, an AppleScript information-stealing component, and a Mach-O format RAT.
  4. Browser cookies and credentials, Keychain, SSH/cloud credentials, and cryptocurrency wallet data are collected.
  5. A signed helper with screen recording permissions and a modified wallet app designed to steal recovery phrases are also used.

Vector 3: AMOS: ChatGPT and Grok Fake Disk Cleanup Instructions

  1. ChatGPT and Grok shared conversations appearing in search results pose as instructions to free up disk space on macOS.
  2. The user pastes and executes a command in Terminal to retrieve a loader.
  3. Credentials obtained via a fake password prompt are verified and used for privilege escalation and information theft.
  4. AMOS collects and exfiltrates browser, Keychain, and wallet data, and replaces certain wallet applications with modified versions.
  5. A LaunchDaemon and monitoring script restart the infostealer to maintain persistence.

Vector 4: PasteSwitch: Luring macOS Users via Ads on the Official HBO Max Reddit Account

  1. The compromised official HBO Max Reddit account distributed 108 malicious ads over approximately 48 hours.
  2. The ads directed users to pages such as fake HBO Max apps, prompting macOS users to paste and execute commands in Terminal.
  3. At the time researchers investigated, HBO Max distribution had ceased, and technical investigations into the delivery infrastructure proceeded using execution commands from a related fake Alfred page.

Vector 5: PasteSwitch: macOS Infostealer and Windows Amatera Delivery Identified in Related Research

  1. ADAMnetworks tracked fake app landing pages and related infrastructure, organizing delivery vectors spanning multiple operating systems and timeframes.
  2. The MacSync vector collects credentials and creates /tmp/osalogging.zip, which is then exfiltrated via HTTP PUT in approximately 10MB chunks.
  3. Another fake Claude page displays a command using mshta for Windows, launching PowerShell from a file treated as both an MP3 and an HTA.
  4. The Windows vector executes Amatera via scheduled tasks, AMSI bypass, and in-memory loading. This vector is not treated as the infection vector confirmed in the 108 HBO Max ads.

Vector 6: Alternative MacSync Vector: Distribution via iCloud Calendar from Fake Apps

  1. In another vector analyzed by Kaspersky, users acquire a fake app DMG, run the application, and launch an initial loader; this does not follow the same sequential steps as previously reported Claude shared conversation and manual copy-paste vectors.
  2. At least one sample retrieved public iCloud Calendar contents and passed them to zsh, executing commands embedded within the event description field. Other samples used alternative retrieval methods, meaning this vector is not common to all infections.
  3. Subsequent stages include a Swift-based infostealer and an Objective-C backdoor disguised as Finder. Persistence mechanisms utilizing LaunchAgent, .zshrc, and global Git hooks were also identified.
  4. Browser extension distribution and Ledger-related command names were also analyzed, but since some scripts could not be retrieved by researchers, the exact operation of each function or their execution in victim environments has not been uniformly verified.

Vector 7: Custom GPT "Plus 5.6" Leading to ClickFix and RAT

  1. Google sponsored ads redirect users to an attacker-created Custom GPT hosted on legitimate chatgpt.com.
  2. The Custom GPT directs users to a fake Cloudflare CAPTCHA page on Google Sites, prompting them to paste and execute a PowerShell command.
  3. PowerShell retrieves an obfuscated script and an MSI package from a decimal-encoded IP address, then silently installs the MSI using msiexec.
  4. DLL sideloading is performed using legitimate signed applications from Canon or Stardock alongside a modified DLL, launching an encrypted loader contained within a WAV file or NuGet package.
  5. Registry Run keys and scheduled tasks are configured to execute the RAT in memory.

Vector 8: ANY.RUN Aggregate: Command Execution via Fake CLIs, Verification Screens, and Shared AI Pages

  1. Fake CLI installation instructions, fake verification screens, and shared AI pages lure users into pasting and executing commands. These represent multiple distinct campaigns, and not all share the same AI sharing page.
  2. When users execute commands containing PowerShell, mshta, curl, or similar utilities, loaders or MSI packages corresponding to the vector are retrieved.
  3. Individual samples deploy infostealers or RATs. The subsequent headless Edge and fake login activities described below are not mandatory subsequent stages for this vector.

Vector 9: ANY.RUN Aggregate: Fake Claude Installer and Browser Information Stealer

  1. Obtaining and executing a trojanized installer from a fake Claude distribution page runs a legitimate installer in the foreground while performing malicious operations in the background. Command pasting is not required.
  2. An mseupdate task is registered, and Microsoft Edge is launched with --headless and --remote-debugging-port=9222.
  3. Cookies and extension data are sent to endpoints such as /api2.php?method=sendcookjson. Although one of the transmission types is named sendkeys, that name alone does not confirm the type or contents of keys.

Vector 10: ANY.RUN Aggregate: Fake Ad Invitations and Browser-in-the-Browser

  1. Users are lured to pages mimicking ad account integrations, registering user information while maintaining communication with the operators. An unsubscribe mailto link suggests email distribution, but this does not imply that actual emails were reviewed.
  2. A Connect action renders a fake Google login window (Browser-in-the-Browser) inside the real browser page.
  3. Authentication credentials entered by the user into the fake screen are transmitted to the operators. This vector does not require malware or installer execution.

4. Attacker Positioning and Execution Locations

  • External threat actors lure users via ads, search results, and public AI sharing pages.
  • Post-execution, they operate as RATs and infostealers on victim endpoints, accessing credentials and wallets.
  • In the Custom GPT vector, attackers combine Google ads, a chatgpt.com Custom GPT, Google Sites, and distribution servers to execute PowerShell and MSI packages on Windows endpoints.
  • In campaigns aggregated by ANY.RUN, attackers combine legitimate hosting services, search ads, shared AI pages, and fake installers to prompt developers or enterprise users to execute commands or sign in to fake screens.

5. Victim and Administrator Perspectives

  • Victims and Users: Pages mimicking Claude Desktop, Apple Support, or macOS disk cleanup are displayed, along with requests to paste and execute commands in Terminal. Users may also encounter fake applications, unexpected Full Disk Access or screen recording permission prompts, Custom GPT "Plus 5.6" guidance screens, Cloudflare-themed pages on Google Sites, PowerShell pasting instructions, or update prompts for fake Claude/ChatGPT/Codex tools, developer tools, ad invitations, or Cloudflare verification screens alongside command pasting and sign-in requests.
  • Administrators: User-initiated Terminal/shell executions, suspicious curl traffic, unknown executables, DLL sideloading, and scheduled tasks are observed (the parent process of the shell is not necessarily the browser). Indicators include new external domain connections immediately following visits to legitimate AI domains, data access targeting wallets, the Keychain, or browsers, and execution chains consisting of PowerShell -> msiexec -> signed legitimate apps under LOCALAPPDATA -> modified DLL -> Run key/scheduled task, as well as mshta/PowerShell/curl, the mseupdate scheduled task, Edge remote debugging port 9222, and traffic to backend paths such as /api2.php.

6. Success and Failure Conditions

Success Conditions

  • In malware distribution vectors, users must trust search ads, sharing pages, or social media ads and execute fake applications or instructed commands. Shared AI pages are not a common prerequisite for all vectors.
  • Command-pasting vectors require shell execution, while fake-installer vectors require running the downloaded executable. Both are not required as identical steps.
  • In malware distribution vectors, application control or security controls must not block the loader, DLL loading, or information access. This is separate from conditions required for credential theft via fake logins.
  • In Custom GPT/Google Sites vectors, users must execute the ClickFix PowerShell command, allowing MSI installation and DLL sideloading to succeed.
  • In Browser-in-the-Browser vectors, users must input authentication credentials into the fake login screen. Entering credentials into a fake installer is not a universal condition.

Failure Conditions and Mitigations

  • Inference: Inspect redirection destinations and downloads from sharing pages, blocking them if identified as malicious.
  • Inference: Control unauthorized script execution on endpoints to handle vectors where users paste commands from sharing pages. Restricting browser child processes alone will not prevent this entire vector.
  • Inference: Restricting malicious DLL loading, persistence, and credential access via application control or EDR helps mitigate subsequent damage.
  • Do not unconditionally trust the publisher of signed binaries solely based on their signature; inspect unusual installation paths, parent processes, and unsigned DLLs in the same folder.
  • Control mshta, wscript, unauthorized PowerShell, and unknown installers using AppLocker, WDAC, or ASR, and deploy a catalog of approved AI tools.

7. What Happens Upon Success

  • RAT infection and remote control of Windows and macOS endpoints.
  • Exfiltration of browser cookies and credentials, Keychain, SSH/cloud authentication keys, and cryptocurrency wallet data.
  • Inference: If stolen sessions or keys are valid, this can lead to unauthorized access to SaaS/cloud environments or cryptocurrency theft.
  • The Custom GPT vector RAT provides capabilities for remote desktop access, capturing screens, cameras, and microphones, accessing browsers and files, and executing additional payloads.
  • Exfiltration of cookies and extension data via headless Edge in the fake installer example, and credential theft in the alternative fake login vector. The transmission identifier sendkeys alone does not determine the type or content of private keys.

8. Observable Logs

Options for investigation within your organization are listed below. Feasibility depends on products, permissions, log settings, and retention periods, and the absence of logs does not prove a lack of compromise.

  • Email: Traditional cases primarily center around search ads, SEO, and social media ads. While ANY.RUN's fake ad invitation pages feature an unsubscribe mailto link suggesting email distribution, this is distinct from verifying actual emails. Correlate available email logs with browsing records.
  • Proxy / SWG / DNS: Inference: Examine records of navigation from AI sharing pages or Reddit ads to external fake app pages, as well as connections to payloads and C2 servers. Do not treat browsing AI sharing pages as a mandatory prerequisite for all vectors. Verify connections to Custom GPT URLs, Google Sites anti-bot spoofing pages, decimal IP 1614733393, and 96.62.224[.]81. Inference: Correlate path patterns such as /curl/<64hex>, sites.google.com/view/antibot<digits>, /api.php?k=, and /api2.php?method=sendcookjson with execution events.
  • Endpoint / EDR: Inference: Depending on EDR coverage, analysts can identify user-launched shells and curl, DLL loading, scheduled tasks, and access to credential files. Direct parent-child relationships between browsers and shells are not assumed. Check for PowerShell -> msiexec, COTFileReadApp.exe/DeElevate64.exe, Canon Configuration Reader / Stardock DeElevation Tool Run keys, and tasks. Differentiate between command-pasting vector components (mshta/PowerShell/curl) and alternative fake-installer examples (mseupdate, Edge remote debugging port --remote-debugging-port=9222).
  • Identity / IdP: Inference: Check for usage originating from unknown sources involving stolen cookies, cloud authentication keys, or SSH keys.
  • SaaS / Cloud: Inference: If stolen tokens are abused, review operational history in SaaS/cloud environments to identify the source and targets. AI sharing page browsing vectors should be investigated via available browser history or proxy logs.
  • Network: Inference: Confirm C2 communications for SectopRAT, MacSync, and AMOS, references to smart contracts used in EtherHiding, and unusual bulk transmissions of credentials. Inference: For the PasteSwitch MacSync vector, examine chunked PUT transmissions, upload_id, chunk_index, and total_chunks if HTTP records are available. In encrypted communications, destination and volume alone are insufficient to confirm data exfiltration. Communications to DoH resolvers should be correlated with preceding ClickFix, MSI installation, and DLL sideloading activities rather than judged malicious in isolation. Check for local access to Edge remote debugging port 9222 and transmissions to backend paths such as /stats-claude-collector.php, /api4.php?method=auth, and /api2.php.

9. Attack Success Determination

Confirmed in Public Information

  • User Action Confirmed: Public Information: Huntress reported execution of fake Claude Desktop and user-driven command execution across MacSync and AMOS cases. These three distinct incidents should not be treated as a single victim's continuous actions.
  • Malware Execution or Authentication Success Confirmed: Public Information: SectopRAT infection via FakeAgent, MacSync infostealer capabilities and RAT, and AMOS execution and persistence have each been reported.
  • Information Theft or Session Compromise Confirmed: Public Information: Huntress reported data exfiltration and analyzed the data collection targets for each malware variant. This does not imply that all types of sensitive information were stolen from every victim endpoint.
  • Subsequent Compromise Confirmed: Criteria: Confirmed when unauthorized use of stolen sessions or authentication keys or unauthorized fund transfers are identified. The source material in this article does not establish the full scope of such successes.
  • Information Theft or Session Compromise Confirmed: Public Information: ADAMnetworks analyzed collection and exfiltration processes for MacSync and Amatera during PasteSwitch-related research. This does not indicate the total volume of infections or data theft resulting from the 108 HBO Max ads.
  • Malware Execution or Authentication Success Confirmed: Public Information: Huntress recovered samples from victim endpoints and analyzed MSI packages, DLL sideloading, persistence, and RATs. Criteria: Confirmed when an organization identifies the execution of modified DLLs and RAT loaders from signed legitimate apps, or persistence and RAT behavior. Scope: Custom GPT / Google Sites ClickFix Campaign
  • Initial Execution Confirmed: Public Information: ANY.RUN observed command and fake installer execution, task registration, and headless Edge launching through individual analyses in a controlled sandbox. The 1,258 instances represent an aggregation of public analyses and do not reflect total successful infections, the number of victim organizations, or the volume of real-world attack attempts. Scope: Public sandbox analyses from April 15 to October 5, 2026. Differentiate between individual sample behaviors and aggregate denominators.

Differentiate between contact, execution, persistence, data acquisition, and exfiltration; do not infer unconfirmed success from a single alert.

10. Investigation Playbook

  • Investigation Starting Point: Initiate investigations from suspicious external redirections originating from AI sharing pages or Reddit ads, user-driven command execution, or execution of unknown applications. Use the Custom GPT "Plus 5.6", Google Sites anti-bot spoofing pages, decimal-encoded IPs, silent MSI deployment, and Canon/Stardock signed application alerts as starting points, alongside pasted executions of mshta/PowerShell/curl, the mseupdate task, headless Edge launches, and fake AI sign-in screens.
  • Initial Verification: Preserve the identities of ad/post publishers, source and destination URLs, retrieved files, and execution commands with timestamps. Differentiate between the HBO Max ad macOS vector and related Windows vectors from separate pages.
  • Endpoint / Server Investigation: For Windows, check for DLL sideloading, scheduled tasks, and RAT activity. For macOS, inspect shell history, quarantine attributes, LaunchAgents/LaunchDaemons, AppleScript, TCC permissions, and modified wallet apps. For PasteSwitch, examine macOS /tmp/osalogging.zip, Windows mshta, PowerShell, and scheduled tasks according to the confirmed vector. Direct browser child process relationships are not mandatory prerequisites. In addition, preserve MSI packages, co-located modified DLLs, WAV/Build.dat files, Run keys, scheduled tasks, in-memory payloads, headless browser command-line arguments, port 9222 access, browser profile access, and staging mechanisms/installers.
  • Identity / Cloud Investigation: Inspect browser sessions, SSH/cloud authentication keys, Telegram, cryptocurrency wallets, and IdPs for unauthorized origins and token creation.
  • Subsequent Operations: Check for reused browser cookies, cloud API enumeration, wallet transfers, and additional RATs or remote administration tools. Inference: Track cookie reuse, browser extension modifications, unauthorized use of developer credentials/cloud tokens, and additional payloads. Do not treat the transmission name sendkeys as evidence of specific private key exfiltration.
  • Containment: Isolate endpoints to preserve evidence, invalidate browser and IdP sessions, and revoke exposed tokens. Reissue SSH and cloud authentication keys, and consider migrating assets to a newly created secure wallet if recovery phrases were exposed. Add malicious sharing URLs, redirection domains, and hashes to organizational blocklists.
  • Judgment Categories: Differentiate page views, user execution, loader success, C2 communication by RAT/infostealer malware, sensitive data exfiltration, and subsequent abuse.

11. Defense and Detection Ideas

  • Single Events: Inference: Treat suspicious retrieval and execution commands within user-initiated Terminal, PowerShell, or cmd sessions as detection candidates. Do not mandate browser child process relationships. Inference: Check for signed helpers loading unknown DLLs from the same directory in conjunction with file provenance. Identify events where PowerShell launches GUID-style MSI packages from TEMP directories using msiexec /qn /norestart, as well as Edge/Chromium launching from non-standard processes with --headless and --remote-debugging-port=9222.
  • Time-Series Correlation: Inference: Correlate timestamps for user access to AI sharing pages or social media ads, external redirections, and subsequent app/shell execution and credential access on the same endpoint. Maintain vector-specific branches. Correlate Google Ads -> Custom GPT -> Google Sites -> PowerShell -> MSI -> signed legitimate apps -> persistence. Separately correlate command-pasting vectors (page view -> shell/loader execution), fake-installer examples (executable -> mseupdate -> headless Edge -> cookie exfiltration), and fake login vectors (page view -> input -> account abuse).
  • Threat Hunting: Inference: Cross-search commands, downloads, DNS queries, and credential access executed before and after viewing suspicious sharing URLs, ads, or redirection targets. Widen initial search windows based on execution delays or log retention periods. For additional vectors, correlate suspicious DMG/app execution with Calendar retrieval, zsh execution, processes disguised as Finder, and modifications to LaunchAgents, .zshrc, or global Git hooks. Do not classify legitimate Calendar access as malicious in isolation. Search for Canon/Stardock binaries under LOCALAPPDATA\Programs, adjacent modified DLLs, and identically named Run keys/tasks. Furthermore, search all endpoints for the mseupdate task, port 9222, mshta/PowerShell/curl, and traffic to fixed backend paths.
  • Log Limitations: Without complete URLs, redirections, clipboard contents, process parent-child relationships, and TCC history, distinguishing between legitimate AI usage and attack vectors can be challenging.
  • Prioritized Mitigations: Inference: Prioritize correlating page views with manual shell execution, application control, inspecting external redirection destinations, and credential revocation procedures. Prioritize establishing an approved AI tool catalog, MDM-based deployment, AppLocker/WDAC/ASR, and browser session invalidation procedures.

12. Facts, Inference, and Hypothesis

Facts

  • In the FakeAgent campaign, Bing sponsored ads directed users to legitimate Claude Artifacts, which then led via fake Claude Desktop distribution domains to deploy SectopRAT. Huntress confirmed activity across at least 29 organizations.
  • FakeAgent combined DLL sideloading using a signed jcef_helper.exe and a modified libcef.dll, scheduled tasks disguised as DockerDesktop.exe, VMProtect, GPU-based virtual environment detection, and EtherHiding utilizing smart contracts on the BSC network.
  • In the MacSync campaign, Google sponsored ads directed users to fake Apple Support instructions on claude.ai/share, prompting users to paste Terminal commands containing curl, which deployed a 6-stage loader, an AppleScript information-stealing component, and a Mach-O RAT.
  • Huntress reported that MacSync collects browser cookies and credentials, the Keychain, Telegram data, SSH/cloud authentication keys, and cryptocurrency wallet data, while also utilizing a signed helper for screen recording permissions.
  • Huntress reported an AMOS incident in December 2025 where ChatGPT and Grok shared conversations appearing in search results posed as disk cleanup instructions, luring users into pasting and executing commands.
  • Publicly available reporting does not establish that AI vendor infrastructure was compromised; the reported attacks abused trust in legitimate hosts and brands.
  • According to Hudson Rock and ADAMnetworks, 108 malicious ads were distributed from a compromised official HBO Max Reddit account over approximately 48 hours, luring macOS users to fake software pages.
  • Ad destinations included domains such as hbomaxx.app. Following the cessation of HBO Max distribution, ADAMnetworks pursued technical investigations using commands retrieved from a related fake Alfred page.
  • The MacSync analyzed in related research was equipped to collect browser credentials and cookies, cryptocurrency wallet data, Telegram data, Apple Notes, Keychain data, cloud credentials, and shell history, package the collected data in /tmp/osalogging.zip, and send the archive via HTTP PUT in approximately 10MB chunks.
  • A Windows vector on a separate fake Claude page utilizes mshta, PowerShell, and files interpreted as both MP3 and HTA, executing Amatera in memory via scheduled tasks and AMSI bypass. This vector was identified during broader PasteSwitch-related research.
  • On September 24, 2026, Kaspersky reported an alternative MacSync vector beginning with fake apps, deploying a Swift-based infostealer and an Objective-C backdoor. Certain samples executed public iCloud Calendar contents via zsh. There are no reports indicating that vulnerabilities in Calendar or iCloud were exploited.
  • Huntress handled at least 40 cases related to the same Google Sites domain, confirming two originated via Custom GPTs. Not all 40 cases originated from Custom GPTs.
  • The Custom GPT "Plus 5.6" directed users from legitimate chatgpt.com to a fake Cloudflare CAPTCHA page on Google Sites, prompting them to silently install an MSI package via PowerShell.
  • The first variant utilized a Canon-signed COTFileReadApp.exe and a modified ceiinfolog.dll, while the second variant utilized a Stardock-signed DeElevate64.exe and a modified DeElevator64.dll, both reaching the same RAT.
  • The RAT features screen, camera, and microphone capture, information collection from 17 browsers, file search, host discovery, additional payload execution, and DNS-over-HTTPS (DoH) C2 communication.
  • ANY.RUN aggregated 1,258 public sandbox analyses between April 15 and October 5, 2026, reporting 601 fake Claude-related cases (48%) and 418 fake ChatGPT/Codex-related cases (33%), totaling 81% across both categories.
  • The same aggregation identified 561 cases (45%) involving command pasting and execution (341 InstallFix cases, 220 ClickFix cases), which researchers noted represents a lower bound based on visible telemetry.
  • Newly organized vectors include steering users from GitHub/GitLab Pages, Cloudflare Pages, Google Sites, or claude.ai/chatgpt.com sharing pages to fake screens, connecting to mshta, PowerShell, curl, or fake sign-in screens.
  • A trojanized Claude installer example registered an mseupdate task, launched headless Edge with remote debugging port 9222, and transmitted cookies and extension data to endpoints such as /api2.php?method=sendcookjson. sendkeys is merely a transmission type identifier and does not specify key types or contents.
  • In the fake ad invitation Browser-in-the-Browser vector, fake login dialogs were rendered within real browser windows, utilizing backend paths such as /api/create/user, /api/send/ip, /api/checkBan, and /api/checkDone.
  • ANY.RUN concluded that execution commands (mshta/PowerShell, etc.), scheduled tasks, headless browsers, and backend paths provide more stable detection indicators than domain names.

Inference

  • Relying solely on URL reputation data that permits domains like claude.ai wholesale may cause analysts to overlook malicious content hosted on legitimate services combined with external redirections.
  • It is necessary to correlate navigation to external pages and manual script execution while distinguishing whether the source was a legitimate AI sharing page or a compromised social media account ad.
  • Individual permission decisions for Custom GPTs, Google Sites, or signed binaries are insufficient; analysts must correlate the entire chain of behavior from ad transition through silent MSI deployment, DLL sideloading, and persistence.

Hypothesis

No additional hypotheses. Unverified items are documented under "Unresolved Questions and Further Investigation."

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1204.002 User Execution: Malicious File high In FakeAgent, users execute an executable distributed as fake Claude Desktop. Source
T1204.004 User Execution: Malicious Copy and Paste high MacSync and AMOS distribution vectors prompt users to paste and execute commands in Terminal. Source
T1574.001 Hijack Execution Flow: DLL high Mapped to DLL sideloading involving FakeAgent's signed helper and modified libcef.dll, as well as Canon/Stardock signed executables and modified DLLs in the Custom GPT vector. Source
T1053.005 Scheduled Task/Job: Scheduled Task high Creates scheduled tasks masquerading as DockerDesktop.exe on Windows. Source
T1555.003 Credentials from Password Stores: Credentials from Web Browsers high MacSync and AMOS collect browser cookies and credentials. Source
T1586.001 Compromise Accounts: Social Media Accounts high The official HBO Max Reddit account was used to distribute malicious ads. Source
T1218.007 System Binary Proxy Execution: Msiexec high ClickFix PowerShell commands utilize msiexec to silently install malicious MSI packages. Source

T1189 is not assigned because simply viewing shared pages or ads does not demonstrate client software exploitation. Manual execution is mapped to T1204.002/T1204.004, and DLL loading is mapped to the current T1574.001. The basis for the Canon/Stardock vector is Huntress's sample analysis.

14. Unresolved Questions and Further Investigation

  • A complete list of malicious Claude Artifacts, Shares, and ChatGPT/Grok shared URLs.
  • Attribution of ad accounts and campaign operators.
  • The longevity and evolution of all C2 servers, smart contracts, and payload hashes associated with FakeAgent.
  • Whether multiple campaigns share common operators or automate the creation of AI sharing pages remains unverified.
  • The compromise vector for the official HBO Max Reddit account and the total number of infections resulting from the 108 ads.
  • Infection counts, operators, scope of iCloud Calendar abuse, and actual functions of unretrieved scripts for the newly reported MacSync vector.
  • Creators and ad accounts for the Custom GPT campaign, and inflow vectors other than Custom GPT among the 40 cases.
  • Final C2 addresses for the RAT and methods for retrieving runtime configurations.
  • The exact contents of ANY.RUN's transmission type sendkeys, actual emails for fake ad invitations, and the extent to which public sandbox aggregations map to real-world incident counts remain unconfirmed.

15. Impact on SOCs and Organizations

Even when routed through AI sharing pages or official social media account ads, external download destinations and executed commands should not be trusted implicitly. Because manually opened Terminals do not necessarily run as browser child processes, analysts must correlate user browsing and execution on the same endpoint using timestamps. HBO Max ad scenarios must be distinguished from separate delivery vectors identified in related research when establishing detection conditions. Furthermore, while domains for fake AI tools may have short lifespans, executed commands, scheduled tasks, headless browser launches, and backend paths remain relatively stable indicators. Because developer workstations reside close to source code repositories and cloud tokens, investigations into confirmed infections should examine not only browser cookies but also SSH keys, package registries, CI/CD pipelines, and cloud credentials.

16. Summary by Role

  • For SOCs: Correlate external redirections from AI sharing pages or social media ads with subsequent application/Terminal execution and credential access on a per-vector basis.
  • For Administrators: Avoid unconditional permissions for AI sharing pages, and implement application whitelist controls, script execution controls, and correlation monitoring between browser browsing and shell execution.
  • For Users: Do not execute downloaded files or Terminal commands provided in ads or AI responses without verifying the distribution source and organizational procedures.

Top comments (0)