FakeAgent: Claude Desktop Malvertising Delivering SectopRAT via Blockchain-Resolved C2

A malvertising and search engine poisoning campaign abused a legitimate AI vendor domain as its delivery surface. Victims searching for the Claude desktop application were served sponsored results, one of which pointed at a publicly hosted artifact on the vendor's own domain rather than at attacker infrastructure. The artifact was user generated content that presented itself as an official download page and accumulated roughly seven thousand page views before it was reported and removed. Clicking its download button sent the victim through two attacker controlled hosts before delivering a fake installer, so the trust the victim extended to the vendor domain carried through to an executable that domain never served.

The delivered installer masquerades as the requested application but is instead a repackaged JetBrains Chromium Embedded Framework helper binary, legitimately signed and used for DLL side-loading of a tampered Chromium Embedded Framework library. The library is protected with a commercial packer and resolves its next-stage location from a smart contract on the BNB Smart Chain using the EtherHiding technique, allowing the operator to rotate infrastructure through on-chain updates rather than domain changes. A second, functionally identical installer masquerading as a container management tool is written to disk and registered as a scheduled task for persistence. The campaign also drops a legitimately signed statistical analysis binary into a user-writable directory whose name mimics a Microsoft update path, again paired with a tampered library for DLL side-loading.

The second stage incorporates multiple anti-analysis techniques. It enumerates graphics adapters for identifiers associated with common hypervisors, checks for undersized video memory, and times a compute shader, refusing to execute when the environment appears to be virtualized. Its payload is stored on disk as an encrypted data file, with decryption performed by a compiled graphics shader to hinder conventional analysis techniques. The recovered payload contains a heavily obfuscated managed assembly identified as SectopRAT, targeting browser credentials, cookies, autofill data, payment card information, Chromium key material, file transfer credentials, and messaging client data, while also providing remote desktop capability. The malware resolves its command-and-control address from a second smart contract on the same blockchain.

Operator tradecraft was better on the malware than on the infrastructure. The registration email behind the redirect domain was recoverable before the hosting provider redacted it, and it links to ten distinct malicious domains going back to December 2025, one of which was seized in a coordinated international takedown for hosting a different commodity stealer. The same operator ran an equivalent campaign in April 2026 that impersonated container tooling and reused the identical library sideloading pattern, and the smart contract transaction history exposes command and control addresses reaching back to May 2025. Endpoint telemetry across affected organizations showed the same triad in every case: an unusual executable install, a Windows Defender exclusion, and anomalous persistence, which is the practical detection surface here regardless of how the payload itself is obfuscated.