[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$faSICWKZQIcbuYTBRiQW3wHZhdTJAiVvwQnwUmS1mgQo":3},{"article":4,"iocs":50,"watch_terms":54,"solutions":55,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"f9b19c3f-0e2b-4841-9efe-be0a2fc684b7","FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations","fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29--3d03e6","Researchers at Huntress have disclosed a malvertising campaign that abused a public artifact hosted on Anthropic’s own claude.ai domain to distribute the SectopRAT information-stealing Trojan, compromising at least 29 organisations in the space of two days. The campaign, which Huntress has named FakeAgent, ran between 21 and 22 July 2026. Victims searching for “Claude Desktop […] The post FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations appeared first on IT Security Guru.","Researchers at Huntress uncovered a malvertising campaign dubbed FakeAgent that abused public artifacts hosted on Anthropic's claude.ai domain to distribute the SectopRAT information-stealing Trojan. The campaign compromised at least 29 organizations between July 21–22, 2026, targeting users searching for Claude Desktop. The attack leveraged Anthropic's trusted infrastructure to evade detection and increase credibility.","FakeAgent campaign exploits Anthropic Claude artifacts to distribute SectopRAT malware to 29 organizations.","https:\u002F\u002Fwww.itsecurityguru.org\u002F2026\u002F07\u002F23\u002Ffakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations\u002F?utm_source=rss&utm_medium=rss&utm_campaign=fakeagent-campaign-malicious-claude-artifact-used-to-distribute-sectoprat-to-29-organisations",null,"2026-07-23T10:29:35+00:00","2026-07-23T12:00:26.007783+00:00",8,[17,20,23,25,28],{"name":18,"type":19},"FakeAgent campaign operators","threat_actor",{"name":21,"type":22},"Claude Desktop","product",{"name":24,"type":22},"Claude Artifacts",{"name":26,"type":27},"Anthropic","vendor",{"name":29,"type":27},"Huntress","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":12,"name":32,"slug":33},"Malware","malware",[35,40,45],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":46},{"id":47,"icon":12,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":33,"value":52,"context":53},"SectopRAT","Information-stealing Trojan distributed via FakeAgent malvertising campaign",[26,29,21],{"controls":56,"vendors":143},[57,86,114],{"slug":58,"name":59,"problem":60,"products":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":49,"name":87,"problem":88,"products":89},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[90,98,106],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"slug":115,"name":116,"problem":117,"products":118},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",[144],{"slug":145,"name":29,"logo_path":146,"roles":147},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[148],"reported_by",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":166},"fakeagent-campaign-abuses-trusted-claudeai-domain-to-deliver-sectoprat-infostealer","FakeAgent Campaign Abuses Trusted Claude.ai Domain to Deliver SectopRAT Infostealer","Attackers in the FakeAgent campaign exploited user trust in Anthropic's legitimate claude.ai domain by hosting malicious artifacts on the platform itself, effectively weaponizing a reputable service to bypass security controls and increase victim credibility. This is a classic supply chain trust abuse: because the payload was served from a known, allowlisted domain, traditional reputation-based defenses failed to flag it. At least 29 organizations were compromised within a 48-hour window, demonstrating how rapidly malvertising campaigns can scale when leveraging trusted infrastructure. The SectopRAT infostealer deployed in this campaign can harvest credentials, browser data, and sensitive system information, making the downstream impact significant. This case underscores that domain reputation alone is not a sufficient security signal — content and behavior must also be scrutinized.",[154,155,156,157,158,159,160,161,162,163,164,165],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 SA-12: Supply Chain Risk Management","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","NIST CSF DE.CM-1: Network Communications Monitoring","NIST CSF PR.AT-1: Security Awareness Training","MITRE ATT&CK T1583.006: Acquire Infrastructure – Web Services","MITRE ATT&CK T1204.002: User Execution – Malicious File","ISO 27001 Annex A 8.7: Protection Against Malware","ISO 27001 Annex A 5.21: Managing Information Security in the ICT Supply Chain",{}]