# Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Malvertising via a public Claude.ai artifact delivered a fake Claude Desktop that DLL-sideloaded libcef.dll/tempdir.dll to install SectopRAT, hitting 29 orgs.

- Payout: Real-world hack
- Severity: high
- Program: Claude Desktop
- Analysis by: Huntress
- Disclosed: 2026-07-22
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
- Tags: area:os domain:desktop impact:ato impact:data-leak impact:pii-leak kind:incident platform:threat-intel sev:high tech:chromium tech:evm tech:windows technique:chained

**Target:** Windows desktop app (Chromium Embedded Framework / IBM SPSS binaries) with DLL sideloading
**Root cause:** Signed executables (jcef_helper.exe masquerading as ClaudeDesktop.exe, and IBM SPSS sslconf.exe) load DLLs (libcef.dll, tempdir.dll) from their own directory without validating integrity, so a co-located tampered DLL executes attacker code in a trusted process.
**Steps:**
1. Victim searches Bing for `CLAUDE DESKTOP APP` and clicks a sponsored ad pointing to `claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877`.
2. Artifact's Download button redirects to `claude.ai.download-app[.]us` then `downloading-api.it[.]com/html/claude/win`.
3. Victim downloads and runs `ClaudeDesktop.exe` (actually JetBrains jcef_helper.exe) alongside a tampered `libcef.dll` (VMProtect-packed, references Ethereum contract `0xc1907d7be91f95903ad66d775c397302e7dd9228`).
4. Sideloaded DLL resolves C2 via EtherHiding, downloads `cache.dat`, and installs a persistent scheduled task writing `DockerDesktop.exe` to reinfect.
5. Secondary persistence `%APPDATA\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe` (signed IBM SPSS binary) sideloads malicious `tempdir.dll`, which passes a GPU anti-VM gate and decrypts `appcfg.dat` via a DirectX shader (AES-256-CTR with modified MixColumns).
6. Decrypted payload yields a .NET SectopRAT assembly that exfiltrates browser logins, cookies, autofill, credit cards, FTP, Discord and messaging credentials to C2 `2.24.131[.]246`.
**How found:** SOC detected a wave of unusual executable installs, Defender exclusions and persistence all originating from ClaudeDesktop.exe across 29 orgs; analysts noticed the binary was actually jcef_helper.exe and that libcef.dll's hash didn't match public records, then pivoted to the Ethereum contract and the second sideloaded tempdir.dll.
**Exploitation:** SEO/malvertising funneled victims from Bing to a legitimate Claude.ai-hosted artifact, lending trust; the download chain served a signed-but-hijacked executable with a malicious sideloaded DLL. The stager used EtherHiding for takedown-resilient C2 rotation, then dropped a GPU-gated, shader-decrypted SectopRAT that harvested credentials and card data from 29 organizations.
**Escalation:** Chained trusted-domain hosting + signed-binary DLL sideloading + blockchain C2 rotation + GPU anti-VM + shader-based payload decryption to evade both users and analysts; persistent scheduled task reinfection via DockerDesktop.exe.
**Insight:** Malware can hide C2 config in Ethereum/BSC contract transactions (EtherHiding) and decrypt payloads with DirectX shaders instead of CPU crypto APIs; when static analysis stalls, search decompiled binaries for HttpClient/contract references and reimplement the shader crypto (watch for non-standard MixColumns and transcription errors in key bytes).