2026-07-26 · view entry permalink →
FakeAgent, malvertising hosts a fake AI-desktop-app download page on the vendor's own trusted domain, delivering SectopRAT by DLL side-loading
The interesting part of this campaign is not the payload but the hosting. Huntress reports that between 2026-07-21 and 2026-07-22 "at least 29 organizations fell victim to a malvertising campaign" in which users searching for the Claude Desktop application were served a sponsored result whose link genuinely resolved to claude.ai, the vendor's own domain (Huntress, 2026-07-22). The destination was a public, user-created artifact on the platform, built to imitate the official download page and viewed some 7,100 times before it was removed (Help Net Security, 2026-07-23). Every control that keys on domain reputation (ad-network vetting, corporate URL allowlists, certificate inspection, the user's own glance at the address bar) reported a trustworthy destination, because the destination genuinely was the vendor's site. Only the onward redirect to attacker infrastructure serving the installer left the trusted domain.
Execution follows a signed-binary side-loading pattern rather than running unsigned attacker code directly. The fake installer drops a repurposed JetBrains Chromium Embedded Framework helper alongside a trojanised libcef.dll packed with VMProtect; as Huntress puts it, "By maliciously modifying that function in the DLL, an adversary can achieve execution in the context of a trusted and signed executable" (Huntress, 2026-07-22). A second persistence chain repeats the trick with an IBM SPSS binary side-loading tempdir.dll, adding GPU-based anti-analysis checks and an unusual unpacking step, "The malware's decryption routine isn't a typical CPU-based decryption routine: instead, it is a compiled DirectX shader", which moves the decryption work off the CPU paths that sandboxes and emulators instrument. The delivered payload is SectopRAT, an information stealer and remote-access tool with hands-on-keyboard capability (BleepingComputer, 2026-07-23); Huntress is the source for what it reaches for and how it is controlled, plaintext strings referencing browser logins, cookies, autofills and credit cards, and command-and-control data stored in the Ethereum blockchain, the takedown-resistant technique known as EtherHiding (Huntress, 2026-07-22).
Triage: DLL side-loading under signed third-party binaries produces telemetry that looks legitimate at the process level; the signed JetBrains or IBM SPSS executable is genuinely signed, and its presence on a developer or analyst workstation can be entirely normal. The discriminators are location and lineage: the signed helper running from a user-writable download or temporary directory rather than its installed application tree, loading a module of the expected name from that same directory, with no parent installation of the product it belongs to. A browser or installer process as the immediate ancestor, followed by reads of browser credential stores by that process tree, is the sequence worth alerting on; the signed binary alone is not.
Between July 21 and July 22, at least 29 organizations fell victim to a malvertising campaign
By maliciously modifying that function in the DLL, an adversary can achieve execution in the context of a trusted and signed executable
The malware's decryption routine isn't a typical CPU-based decryption routine: instead, it is a compiled DirectX shader