30
30
30
30
45
30
30
45
30
30
30
30
30
30
30
30
30
How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface
Huntress details campaigns abusing Claude Artifacts, claude.ai/share links, and ChatGPT/Grok conversations to deliver SectopRAT, MacSync, and AMOS stealers.
Huntress SOC documented nine months of campaigns in which attackers weaponized trusted AI platform features—Claude Artifacts, public claude.ai/share links, and indexable ChatGPT/Grok conversations—to deliver malware. The July FakeAgent campaign hit more than 29 organizations via a malicious Claude Artifact posing as a Claude Desktop download page that redirected to SectopRAT. A claude.ai/share link disguised as an Apple Support guide tricked a victim into running a curl command that deployed the MacSync stealer, harvesting cookies, credentials, keychain secrets, Telegram sessions, and SSH/cloud keys, while SEO-poisoned ChatGPT and Grok conversations delivered the AMOS stealer via ClickFix-style instructions.
55
30
30
30
30
35
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30