INSIDE FAKEAGENT: HOW A CLAUDE DESKTOP MALVERTISING CAMPAIGN HIT 29 ORGANIZATIONS WITH SECTOPRAT

Summary from the TLDR InfoSec newsletter

A Bing search for "claude desktop app" returned a sponsored link pointing at a genuine claude[.]ai artifact URL, and that user-generated page redirected through claude.ai.download-app[.]us and downloading-api.it[.]com to a ClaudeDesktop.exe that was really JetBrains jcef_helper.exe sideloading a tampered libcef.dll, packed with VMProtect and pulling its next stage from an Ethereum BSC contract using the EtherHiding technique, while a second persistence path dropped a signed IBM SPSS binary as sslconf.exe alongside a malicious tempdir.dll that gated execution on DXGI adapter IDs, sub-1GB VRAM, and compute shader timing to defeat sandboxes, then decrypted its payload with a DirectX shader running a modified AES-256-CTR rather than any hookable crypto API. Huntress traced the resulting SectopRAT build to C2 at 2.24.131[.]246, tied the registrant of download-app[.]us to ten domains going back to December 2025, and matched the tradecraft to a fake Docker Desktop campaign in April that used the same libcef.dll sideloading pattern against 29 organizations between July 21 and 22. Hunt for ClaudeDesktop.exe and DockerDesktop.exe writes, scheduled tasks pointing into %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install, and Defender exclusions added around software installs, block the listed C2 range and the two BSC contracts as pivot indicators, and treat vendor domains as untrusted download sources when the landing page is a user-generated artifact, since the Anthropic disclaimer that artifact content is unverified was the only signal separating this page from a real one before takedown at 7,100 views.