Threat Actors Hijack Trusted AI Platforms to Deliver Malware
Cybersecurity researchers at Huntress have uncovered a disturbing trend in which malicious actors are exploiting trusted AI platforms to deliver malware to unsuspecting users. Over the past nine months, these attackers have successfully weaponized shareable AI content, public mini-apps, and sponsored search placement to target AI users and deploy malicious software.
The AI platform companies themselves remain secure, but it’s their features that are being hijacked by threat actors. One such feature is Claude Artifacts, which allow users to publish and share conversations generated by the AI model. Attackers have been using these Artifacts to host malicious content, including download links for malware-infected software.
In July, a campaign called FakeAgent was launched, in which over 29 organizations were targeted with a fake download page hosted on the real claude.ai domain. The page appeared legitimate due to its similarity to the actual Claude Desktop download page, and victims who clicked on it were redirected to an external domain that delivered the SectopRAT malware.
Another incident involved a sponsored search result for “Claude on Mac” that led to a claude.ai/share link posing as an Apple Support install guide. The fake guide instructed the victim to paste a curl command into Terminal, which kicked off a six-stage chain that deployed the MacSync stealer. This malware harvested sensitive information from the victim’s machine, including cookies, credentials, and SSH keys.
A third pattern of attack involves “AI poisoning,” in which malicious conversations are crafted to give fake troubleshooting advice. In December, a routine search for “clear disk space on macOS” surfaced high-ranking ChatGPT and Grok conversations that gave instructions instead of real fixes. These conversations were crafted by attackers to push the link to the top of Google’s results, where victims trusted the advice and ran the suggested Terminal commands, which delivered the AMOS stealer.
These attacks do not require a vulnerability in the AI platform itself; they rely on the trust users place in familiar brands and real domains. Defenders should treat clipboard-driven execution and AI-assisted troubleshooting as security risks and take steps to mitigate them. This includes restricting script execution from the clipboard, enforcing application allow-listing, and watching for new scheduled tasks and antivirus exclusion.
In practical terms, this means being cautious when interacting with shareable content or following advice from trusted sources, especially if it involves executing Terminal commands or downloading software from unfamiliar domains. By staying vigilant and taking steps to secure our systems, we can prevent these types of attacks from succeeding.
Source: Bleeping Computer — 2026-09-11