Malware campaigns abuse Claude, ChatGPT and Grok sharing pages to spread FakeAgent, MacSync and AMOS

Malware distributors have found a new foothold in the public sharing features of popular AI services. According to BleepingComputer and researchers at Huntress, sponsored search ads and SEO results are steering users to pages hosted on Claude's Artifacts and Share features, as well as shared ChatGPT and Grok conversations, which then talk them into running fake applications or pasting commands straight into the Terminal. The campaigns distribute FakeAgent, MacSync and AMOS, and infections have reportedly been confirmed at multiple organizations.

FakeAgent: SectopRAT on Windows

The Windows campaign begins with a sponsored Bing ad that leads to a genuine Claude Artifact page. A download link inside the artifact points to an external site impersonating the official Claude Desktop download. When the victim runs ClaudeDesktop.exe, Huntress found the malware deploys SectopRAT through DLL side-loading that abuses a legitimately signed helper binary. The infection adds scheduled tasks for persistence, checks whether it is running inside a virtual environment, and uses EtherHiding, a technique that pulls payload data from blockchain smart contracts. SectopRAT then gives the attackers remote access to the machine.

MacSync: a six-stage macOS stealer

For macOS, sponsored Google ads lead to fake Apple Support instructions published on Claude Share. The page tells the user to open Terminal and paste a curl command. Huntress describes the result as a six-stage framework that installs a loader, an information-stealing component built on AppleScript, and a RAT compiled as a Mach-O binary. The stealer goes after browser cookies and saved credentials, the macOS Keychain, SSH and cloud authentication keys, and cryptocurrency wallet data. A signed helper is used to obtain screen-recording permissions, and a tampered wallet application captures recovery phrases.

AMOS: fake cleanup tips on ChatGPT and Grok

The third scenario relies on shared ChatGPT and Grok conversations that surface in search results and pose as guides for freeing up disk space on a Mac. Pasting the suggested Terminal command pulls down a loader. A forged password prompt captures the user's credentials, which the attackers verify and then use for privilege escalation and data theft. AMOS exfiltrates browser, Keychain and wallet data, replaces certain wallet apps with modified versions, and persists through a LaunchDaemon paired with a monitoring script that restarts the info-stealer if it is stopped.

One playbook, separate incidents

Huntress emphasizes that these are three distinct campaigns rather than stages of a single intrusion, though they share a common logic: the AI platforms' domain reputations do the convincing while the malicious execution happens on the endpoint. One practical consequence is that the parent process of the malicious shell is not necessarily the browser, since the user copies the command from the page and runs it manually.

What defenders can monitor

On the endpoint, Huntress points to user-initiated shell sessions, curl traffic, unknown executables, DLL side-loading and scheduled tasks as Windows indicators. On macOS, the checklist includes shell history, quarantine attributes, LaunchAgents and LaunchDaemons, AppleScript activity, changes to privacy permissions, and modified wallet applications. On the network side, transitions from a legitimate AI sharing URL to a newly registered or lookalike download domain, command-and-control traffic, and blockchain RPC requests are worth flagging.

Why it matters

Public AI sharing pages inherit the trust, and in many cases the clean reputation, of the platforms that host them, which makes them an effective lure for malvertising and SEO manipulation. Because the actual attack executes in the Terminal or through a downloaded binary rather than inside the browser, controls that only sandbox browser child processes will miss the whole pathway. The payloads target exactly the material that hurts most: session cookies, cloud and SSH keys, Keychain contents and wallet seed phrases, so a single successful infection can cascade into SaaS or cloud account takeovers and cryptocurrency theft. As long as these sharing features remain public and indexed by search engines, attackers retain a cheap and credible distribution channel, and organizations that have not planned for trusted domains carrying malicious content are the most likely to be caught out.