CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

FakeAgent

campaign · campaign:fakeagent

Malvertising campaign named by Huntress that compromised at least 29 organisations between 2026-07-21 and 2026-07-22. Sponsored search results for the Claude Desktop application linked to a genuine claude.ai URL whose destination was a public user-created artifact on the platform imitating the official download page, viewed roughly 7,100 times before removal, so the ad, the domain and the certificate all presented as legitimate before an onward redirect to attacker infrastructure served the installer. Execution runs through signed-binary side-loading (a repurposed JetBrains Chromium Embedded Framework helper loading a VMProtect-packed trojanised libcef.dll, with a second chain using an IBM SPSS binary and a compiled DirectX shader as its decryption routine) and delivers SectopRAT (Huntress, 2026-07-22; Help Net Security, 2026-07-23; BleepingComputer, 2026-07-23).

Coverage
1
0 about it · 1 mention · first 2026-07-26 → last 2026-07-26
Latest activity
–
no entry about it yet
Peak priority
·
no entry about it yet
Targets
·
no sector or region stated
Sources cited
3
3 hosts

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

uses

Story timeline

Every entry that names FakeAgent, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-07-26FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading
    mentionactive-threatsA search ad pointed at a legitimate vendor domain: the lure page was a user-created artifact on the platform itself

Entries about FakeAgent

No published entry is about this entity yet · the story timeline above lists the entries that mention it.

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (33%)
  • helpnetsecurity.com1 (33%)
  • huntress.com1 (33%)
All cited sources (3)