FakeAgent delivered SectopRAT to more than 29 organisations from a page hosted on claude.ai

The Artifact feature did the work that a lookalike domain and a fresh certificate used to do. Claude generates the content, a user publishes it to a public link on claude.ai, and Huntress says public Artifacts get minimal vetting from Anthropic beyond a generic disclaimer ^[6]. The FakeAgent page posed as a Claude Desktop download, and the redirect to SectopRAT fired after the click, on an external domain ^[7].

Anthropic removed the reported Artifact by July 22 ^[8]. Huntress says these campaigns often run only hours or days before a provider pulls the content ^[4]. Incidents tied to the same redirect domain kept appearing into August, at least ten days after the removal ^[8][17]. Taking down the Artifact removed one page. The host behind the redirect kept serving.

The macOS cases are the same shape. The download step becomes a paste step. A victim searching Google for "Claude on Mac" took a sponsored result to a claude.ai/share page dressed as an Apple Support install guide ^[9]. The URL was not a lookalike and there was no certificate warning ^[10]. The guide said to paste a curl command into Terminal, and six stages later the MacSync stealer was running ^[11], harvesting cookies, credentials, keychain secrets, Telegram sessions, and SSH and cloud keys ^[12].

In December the lure was the answer itself. A search for "clear disk space on macOS" returned high-ranking shared ChatGPT and Grok conversations carrying ClickFix-style instructions instead of real fixes ^[13]. Attackers wrote the conversations, hit share to mint a public URL on the platform's own domain, then used SEO poisoning to push the link to the top of Google's results, and the commands delivered the AMOS stealer ^[14].

Scope in what Huntress published is uneven. FakeAgent carries a count of more than 29 organisations in July ^[5]. The claude.ai/share case and the ChatGPT and Grok case are told as single incidents with no victim numbers ^[18].

Huntress's framing is that the day-to-day risk sits in abused platform features, not in attacks on the AI companies or the models ^[1], and it says none of these campaigns broke AI platform security ^[15]. Its mitigations are endpoint and user side: restrict script execution from the clipboard, enforce application allow-listing, watch for new scheduled tasks and antivirus exclusion changes, train users on ClickFix lures, and report suspicious AI-hosted content to the vendor quickly ^[16]. Nothing in the write-up counts how often URL filtering or domain reputation waved claude.ai through, so the allowlist question is an inference from the trust boundary, not a measurement Huntress reports ^[10].