When malware is hosted on claude.ai: AI platforms become an attack surface

Huntress documents nine months of campaigns that hijack AI assistants' share pages. No lookalike URLs, no certificate warnings: the trap is served from the legitimate domain.

Huntress researchers followed for nine months attacks that exploit a very simple property of conversational assistants: the content they generate can be published and shared at an address hosted on the publisher's domain. A Claude artifact, a shared conversation link, a public page produced by a mini-program then become perfectly credible malicious payload hosts.

The campaign called FakeAgent, active on July 21 and 22, 2026, illustrates the mechanism. A sponsored ad on Bing, displayed to Internet users searching for "Claude Desktop app", did point to claude.ai — but to a public artifact imitating the official download page. The download button then chained several domains controlled by the attacker before delivering an executable carrying SectopRAT, a Trojan horse that siphons off logins, files and banking data. At least 29 organizations were affected.

Two other campaigns follow the same logic: a fake installation guide for Apple hosted on a claude.ai sharing page, which distributed the MacSync thief via a curl command, and ChatGPT and Grok conversations artificially escalated in search engines, offering fake ClickFix-type troubleshooting that deployed the AMOS thief. The effectiveness lies in the absence of the usual red flags: the domain is authentic and the certificate is valid.