Three malware campaigns stage their lure pages on Claude and ChatGPT share links

The interesting part of these chains is where the process tree breaks. In both macOS cases the victim reads instructions on a page served by an AI vendor, copies a command, switches to Terminal, and runs it ^[5][9]. The browser downloads nothing. The shell's parent is whatever opened Terminal, and the writeup says so directly: the parent of the shell is not necessarily the browser ^[13]. Rules that alert on a browser process spawning a shell will not fire, and the same writeup notes that restricting browser child processes does not prevent this pathway ^[14]. MITRE's Malicious Copy and Paste technique is listed among the related references ^[20].

The Windows case breaks a different assumption. The Bing ad lands on a genuine Claude Artifact, and the download link inside that artifact points at an external site impersonating Claude Desktop ^[3]. The hostname a proxy logs at click time is one most teams have decided to trust. The executable arrives from a host that was not in the chain at all ^[3]. Once run, it side-loads a DLL through a signed helper and launches SectopRAT, with scheduled tasks, virtual environment detection, and EtherHiding along the way ^[4].

Huntress's suggested network signal is ordering: a new external domain visited immediately after a legitimate AI domain ^[15]. For that to be an alert rather than a queue, first visits to unfamiliar domains right after AI-domain access have to be rare in your environment. In-product links to documentation, repositories, package registries, and vendor sites are the obvious noise source, and nothing in the writeup measures that base rate.

All three chains start with paid ads or search placement and end with the user executing something ^[21]. Two of the three end in Terminal on macOS, one in an .exe on Windows ^[22]. Fake Apple Support instructions served from a Claude Share link is a good trick. There is no CVE; the writeup states the primary vector is search ads and SEO ^[17].

What the macOS chains take is the part that outlives the endpoint: browser cookies and credentials, the Keychain, SSH keys, cloud authentication keys, and wallet data ^[7]. One chain uses a signed helper to obtain screen recording permission and a modified wallet application to capture recovery phrases ^[8]. The other harvests a password through a fake prompt, verifies it, and uses it for privilege escalation ^[10]. AMOS exfiltrates browser, Keychain, and wallet data, replaces certain wallet applications with modified builds, and keeps itself running with a LaunchDaemon and a monitoring script ^[11][12]. Huntress's assessment is that valid stolen sessions or keys lead to unauthorized access to SaaS and cloud environments, or to cryptocurrency theft ^[18].

The severity rating is High, and the stated basis is that infections have been confirmed across multiple organizations and that the technique abuses the trust placed in public pages ^[16]. The writeup does not name those organizations or give a count ^[23]. There is no allowlist entry in it either, so treat the trust here as user trust in an ad result and a familiar hostname, which is what the source actually describes ^[16]. The control it proposes is unglamorous: inspect the redirects and downloads that sharing pages hand out, and block the ones that resolve to malicious hosts ^[19].