At least 29 organizations were compromised between July 21–22 during a malvertising operation researchers call FakeAgent.
How the attack reached victims: Bing ads and a malicious Claude Artifact
Huntress, a managed security company, found a malvertising campaign on the Bing search service that pushed a fake Claude desktop app installer. The attackers used a malicious Claude Artifact hosted on Claude’s legitimate domain to direct visitors to sites that served a fake installer named ClaudeDesktop.exe. That malicious Artifact was downloaded 7,100 times before Anthropic removed it.
Huntress notes this use of a malicious artifact on a legitimate Claude.ai domain repeats a tactic seen earlier this year, when similar lures were used to push macOS malware via ClickFix-themed pages.
Installer technique: legitimate component, malicious DLL sideload
The file presented as ClaudeDesktop.exe was in fact a legitimate JetBrains Chromium component that sideloads a malicious DLL, libcef.dll. That DLL is the loader for the SectopRAT remote access trojan, which delivers information-stealing and remote-interaction capabilities. The campaign achieves persistence through a separate executable, DockerDesktop.exe, which installs a scheduled task.
SectopRAT’s capabilities and distribution methods
SectopRAT—also tracked as ArechClient2—has been active since 2019. Huntress describes it as an information-stealer with HVNC (Hidden Virtual Network Computing) functionality that enables real-time, remote hands-on interaction with a compromised system. The malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from messaging clients including Discord and Telegram, Steam, and VPN products.
Huntress also notes SectopRAT has recently been observed being distributed via CastleLoader campaigns and ClickFix attacks. In this FakeAgent operation the malware uses the EtherHiding technique: the payload retrieves a working command-and-control (C2) address via transactions on the Ethereum BNB Smart Chain.
Evasion, analysis, and infrastructure leads
The loaders and staging components in the FakeAgent chain include multiple anti-analysis measures, Huntress reports. These include VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual machine detection. Those features are designed to frustrate sandboxes and human analysis.
Huntress says it used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET code analysis. Analysis of the decrypted .NET payload identified the tooling as SectopRAT (or a closely related fork) and enabled infrastructure work. At that stage researchers found 10 domains registered to the same email address since December 2025; one of those domains had been previously linked to the StealC distribution and seized during Operation Endgame. Despite these leads, Huntress reports it does not have enough evidence to attribute FakeAgent to a specific, known threat cluster.
What this means for security teams, end users, and procurement leaders
- Security teams: the chain combines malvertising, DLL sideloading of a legitimate component, and staged loaders with anti-analysis checks; Huntress’s findings suggest defenders should look for atypical use of legitimate binaries, scheduled tasks added by unexpected executables (DockerDesktop.exe in this case), and unusual blockchain-based C2 resolution (EtherHiding on the BNB Smart Chain). The Picus whitepaper cited by the reporting underscores the value of breach-and-attack simulation: security teams log 54% of successful attacks and alert on just 14%, so exercising SIEM and EDR detection is a practical countermeasure.
- End users and IT procurement: Huntress warns users looking for software should trust official websites and download portals instead of search results, especially sponsored ones. In this campaign, the installer originated from pages reached through Bing ads and a malicious artifact on a legitimate Claude.ai domain, not from an official product distribution channel.
- Response and threat hunters: the campaign’s use of blockchain-based C2 retrieval and anti-analysis staging suggests analysts should preserve and examine network, scheduled-task, and filesystem artefacts that reveal loader behavior, and consider integrating blockchain-transaction monitoring into C2 discovery playbooks where relevant.
The FakeAgent operation highlights a converging trend in which malvertising and abused legitimate hosting combine with sophisticated evasion and novel C2 retrieval methods. Huntress’s work—enabled in part by automated analysis with Claude Opus 4.8—produced tangible infrastructure leads but stopped short of firm attribution. For organizations, the immediate, concrete steps are clear: prefer vendor sites and verified portals for downloads, harden detection for DLL sideloading and unexpected scheduled tasks, and exercise SIEM/EDR rules with breach-and-attack simulations so fewer intrusions move unseen.
