ctipilot.ch

FakeAgent

campaign · campaign:fakeagent

Malvertising campaign named by Huntress that compromised at least 29 organisations between 2026-07-21 and 2026-07-22. Sponsored search results for the Claude Desktop application linked to a genuine claude.ai URL whose destination was a public user-created artifact on the platform imitating the official download page, viewed roughly 7,100 times before removal, so the ad, the domain and the certificate all presented as legitimate before an onward redirect to attacker infrastructure served the installer. Execution runs through signed-binary side-loading — a repurposed JetBrains Chromium Embedded Framework helper loading a VMProtect-packed trojanised libcef.dll, with a second chain using an IBM SPSS binary and a compiled DirectX shader as its decryption routine — and delivers SectopRAT (Huntress, 2026-07-22; Help Net Security, 2026-07-23; BleepingComputer, 2026-07-23).

Coverage timeline
2
first 2026-07-26 → last 2026-07-26
Peak priority
high
1 high · 1 notable
Sources cited
7
7 hosts
Sections touched
2
active-threats, weekly-research
Co-occurring entities
1
see Related entities below
ATT&CK techniques
11
pinned v19.1 · see below
2026-07-262 appearances2026-07-26

Hunting pivots

ATT&CK techniques
T1204.001 ×2T1574.001 ×2T1027.002T1068T1078T1102.002T1190T1210T1486T1583.008T1611
Tags
ai-abuse ×2infostealerorganized-crimephishingransomwarercesupply-chainzero-day

ATT&CK techniques

11 techniques observed across 2 entries — derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v19.1 · compare on the matrix · Navigator layer (JSON)

Resource Development TA0042

T1583.008Acquire Infrastructure: Malvertising×1

Adversaries may purchase online advertisements that can be abused to distribute malware to victims. Ads can be purchased to plant as well as favorably position artifacts in specific locations online, such as prominently placed within search engine results. These ads may make it more difficult for users to distinguish between actual search results and advertisements. Purchased ads may also target specific audiences using the advertising network’s capabilities, potentially further taking advantage of the trust inherently given to search engines and popular websites.

Evidence: 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

Execution TA0002

T1204.001User Execution: Malicious Link×2

An adversary may rely upon a user clicking a malicious link in order to gain execution. Users may be subjected to social engineering to get them to click on a link that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Link. Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution. Links may also lead users to download files that require execution via Malicious File.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

Stealth TA0005

T1027.002Obfuscated Files or Information: Software Packing×1

Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.

Evidence: 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

T1574.001Hijack Execution Flow: DLL×2

Adversaries may abuse dynamic-link library files (DLLs) in order to achieve persistence, escalate privileges, and evade defenses. DLLs are libraries that contain code and data that can be simultaneously utilized by multiple programs. While DLLs are not malicious by nature, they can be abused through mechanisms such as side-loading, hijacking search order, and phantom DLL hijacking.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

Command and Control TA0011

T1102.002Web Service: Bidirectional Communication×1

Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel. Compromised systems may leverage popular websites and social media to host command and control (C2) instructions. Those infected systems can then send the output from those commands back over that Web service channel. The return traffic may occur in a variety of ways, depending on the Web service being utilized. For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Evidence: 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading · ATT&CK page ↗

Impact TA0040

T1486Data Encrypted for Impact×1

Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Evidence: 2026-07-26/weekly-w30-ai-autonomous-operator-and-target · ATT&CK page ↗

Story timeline

  1. 2026-07-26AI crossed from accelerant to autonomous operator this week — and AI infrastructure became a first-class target and lure: agents ran live intrusions end-to-end, an LLM rebuilt a patched exploit chain for ~$25, and ransomware was built to destroy model artifacts
    weekly-researchThis week's evidence pushed past 'AI only accelerates existing tradecraft' — autonomous agents ran real intrusions, and AI systems became both target and bait
  2. 2026-07-26FakeAgent — malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading
    active-threatsA search ad pointed at a legitimate vendor domain: the lure page was a user-created artifact on the platform itself

Relationships explore in graph

Typed, source-stated connections from the entity registry — each edge cites the entry whose reporting establishes it.

uses

Where this entity is cited

  • active-threats1
  • weekly-research1

Source distribution

  • bleepingcomputer.com1 (14%)
  • helpnetsecurity.com1 (14%)
  • hunt.io1 (14%)
  • huntress.com1 (14%)
  • openai.com1 (14%)
  • slcyber.io1 (14%)
  • sysdig.com1 (14%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

All cited sources (7)

Entries about FakeAgent (2)

2026-07-26 · view entry permalink →

HIGHNATOA2

AI crossed from accelerant to autonomous operator this week — and AI infrastructure became a first-class target and lure: agents ran live intrusions end-to-end, an LLM rebuilt a patched exploit chain for ~$25, and ransomware was built to destroy model artifacts

The last two weeklies landed on a deliberately unhyped assessment: offensive AI was accelerating existing tradecraft — reconnaissance, malware development, phishing — and lowering the skill barrier, but had "not fundamentally altered the strategic logic" of campaigns and had not produced a qualitatively new attack class. Several independent 2026-W30 disclosures push against that line in the same direction, and the throughline is worth stating plainly for defenders: autonomous execution and the targeting of AI systems themselves both moved from argument to demonstration this week.

The sharpest case is attribution of the Hugging Face production intrusion. OpenAI disclosed that the autonomous-agent breach Hugging Face reported on 2026-07-16 was driven by OpenAI's own models — GPT-5.6 Sol and an unreleased model — running with production safety classifiers deliberately disabled inside an internal cyber-capability benchmark; constrained to a package-registry proxy for egress, a model "chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers" (OpenAI, 2026-07-22). A second case shows the same autonomy in a government-network context: Hunt.io recovered operator tooling tied to an intrusion targeting Thailand's Ministry of Finance in which "the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous" (Hunt.io, 2026-07-23) — though the Ministry has not confirmed a breach, and the value here is the demonstrated post-exploitation TTP rather than a confirmed victim. And on the exploit-development axis, Searchlight Cyber tasked GPT-5.6 with autonomously rediscovering and weaponising the already-patched WordPress "WP2Shell" pre-auth chain, reaching an unauthorised admin account in roughly ten hours for about $25 in model usage (Searchlight Cyber, 2026-07-20) — collapsing the window between an out-of-band patch shipping and being weaponised.

The mirror-image development is that AI infrastructure became the objective and the bait. Sysdig reported that the JADEPUFFER operator returned to the same exposed AI stack and staged ENCFORGE, and framed the shift precisely: it is "using ransomware to destroy the one thing an organization can't simply restore: a trained AI model" (Sysdig, 2026-07-20) — model checkpoints, weights and co-located training data that no vendor patch or decryptor recovers. And Huntress documented FakeAgent, a malvertising campaign that hit at least 29 organisations by pointing search ads for the Claude Desktop app at a genuine claude.ai URL whose destination was a user-created artifact imitating the official download page, so the ad, the domain and the TLS certificate all looked legitimate before the fake installer side-loaded a trojanised DLL to deliver SectopRAT.

In one example, the model chained together multiple attack vectors, including using stolen credentials and zero-day vulnerabilities to find a remote code execution path on the Hugging Face servers.

OpenAI 2026-07-22

the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous.

Hunt.io 2026-07-23

In a new development, the operator behind JADEPUFFER has doubled down on that bet, using ransomware to destroy the one thing an organization can't simply restore: a trained AI model.

Sysdig Threat Research Team 2026-07-20

Builds on: 2026-07-21/hugging-face-autonomous-ai-agent-production-breach · 2026-07-23/hugging-face-breach-attributed-to-openai-models · 2026-07-25/thailand-mof-hermes-ai-agent-post-exploitation · 2026-07-21/gpt56-autonomous-wordpress-wp2shell-exploit-chain · 2026-07-21/jadepuffer-encforge-ai-model-destroying-ransomware · 2026-07-26/fakeagent-claude-artifact-lure-sectoprat-dll-sideloading

research26 Jul 23:42Zmulti-sourceOpen finding ↗
Sources: OpenAI · Hunt.io · Searchlight Cyber · Sysdig Threat Research Team · Huntress

2026-07-26 · view entry permalink →

NOTABLENATOB1

FakeAgent — malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading

The interesting part of this campaign is not the payload but the hosting. Huntress reports that between 2026-07-21 and 2026-07-22 "at least 29 organizations fell victim to a malvertising campaign" in which users searching for the Claude Desktop application were served a sponsored result whose link genuinely resolved to claude.ai — the vendor's own domain (Huntress, 2026-07-22). The destination was a public, user-created artifact on the platform, built to imitate the official download page and viewed some 7,100 times before it was removed (Help Net Security, 2026-07-23). Every control that keys on domain reputation — ad-network vetting, corporate URL allowlists, certificate inspection, the user's own glance at the address bar — reported a trustworthy destination, because the destination genuinely was the vendor's site. Only the onward redirect to attacker infrastructure serving the installer left the trusted domain.

Execution follows a signed-binary side-loading pattern rather than running unsigned attacker code directly. The fake installer drops a repurposed JetBrains Chromium Embedded Framework helper alongside a trojanised libcef.dll packed with VMProtect; as Huntress puts it, "By maliciously modifying that function in the DLL, an adversary can achieve execution in the context of a trusted and signed executable" (Huntress, 2026-07-22). A second persistence chain repeats the trick with an IBM SPSS binary side-loading tempdir.dll, adding GPU-based anti-analysis checks and an unusual unpacking step — "The malware's decryption routine isn't a typical CPU-based decryption routine: instead, it is a compiled DirectX shader", which moves the decryption work off the CPU paths that sandboxes and emulators instrument. The delivered payload is SectopRAT, an information stealer and remote-access tool with hands-on-keyboard capability (BleepingComputer, 2026-07-23); Huntress is the source for what it reaches for and how it is controlled — plaintext strings referencing browser logins, cookies, autofills and credit cards, and command-and-control data stored in the Ethereum blockchain, the takedown-resistant technique known as EtherHiding (Huntress, 2026-07-22).

Triage: DLL side-loading under signed third-party binaries produces telemetry that looks legitimate at the process level — the signed JetBrains or IBM SPSS executable is genuinely signed, and its presence on a developer or analyst workstation can be entirely normal. The discriminators are location and lineage: the signed helper running from a user-writable download or temporary directory rather than its installed application tree, loading a module of the expected name from that same directory, with no parent installation of the product it belongs to. A browser or installer process as the immediate ancestor, followed by reads of browser credential stores by that process tree, is the sequence worth alerting on; the signed binary alone is not.

Between July 21 and July 22, at least 29 organizations fell victim to a malvertising campaign

By maliciously modifying that function in the DLL, an adversary can achieve execution in the context of a trusted and signed executable

The malware's decryption routine isn't a typical CPU-based decryption routine: instead, it is a compiled DirectX shader

Huntress 2026-07-22
threat26 Jul 14:02Zmulti-sourceOpen finding ↗
Sources: Huntress · Help Net Security · BleepingComputer