Attackers Turn Trusted AI Sharing Features Into Malware Delivery Channels

Threat actors are exploiting public content hosted by major AI services to distribute malware under the cover of legitimate domains and recognizable branding.

Over a nine-month observation period, Huntress Security Operations Center identified campaigns abusing Claude Artifacts, shared Claude pages, and public ChatGPT and Grok conversations. Rather than compromising the providers or manipulating their underlying models, attackers used standard publishing and sharing functions as a delivery layer.

The campaigns reached both Windows and macOS users and deployed SectopRAT, MacSync, and AMOS. Some malicious pages disappeared within hours or days, but related redirect and malware infrastructure remained active after the AI-hosted content was removed.

Legitimate AI domains create a dangerous trust boundary

The attacks rely on a simple advantage: users are more likely to trust instructions and downloads displayed on claude.ai, chatgpt.com, or grok.com than content hosted on an unfamiliar domain.

Several genuine platform features enabled this approach:

• Claude Artifacts can present generated content in a preview pane and publish it through a public link.
• claude.ai/share pages expose shared conversations that can be distributed through social media, forums, advertisements, and search results.
• ChatGPT and Grok shared conversations can be indexed and ranked by search engines, including for technical-support queries.

These services supply the domain, HTTPS connection, interface elements, and brand identity. Attackers supply the deceptive content.

That distinction matters. There is no reported intrusion into the AI platforms themselves, and no indication that attackers defeated core model or account security controls. They instead turned intended functionality into a social-engineering surface.

No affected software versions have been identified because the campaigns do not depend on a vulnerable application release. There are also no CVE identifiers, CVSS scores, or CISA Known Exploited Vulnerabilities catalog entries associated with the activity.

FakeAgent used a Claude Artifact to impersonate an application download

In July, Huntress tracked a campaign it called FakeAgent, which affected more than 29 organizations. The attackers constructed a fake Claude Desktop and Cowork installation page using a publicly available Claude Artifact.

The page was hosted on the authentic claude.ai domain and imitated an official software download experience. Users searching Bing for the Claude desktop application could encounter the page and select what appeared to be a legitimate download link.

The actual link redirected visitors to an external domain, which delivered SectopRAT malware.

This structure split the attack across two layers. The AI platform supplied the convincing landing page, while infrastructure controlled by the attacker handled redirection and payload delivery. Blocking or deleting only the public Artifact therefore addressed one component of the chain.

Huntress reported the Artifact, and Anthropic removed it by July 22. Incidents connected to the same redirect domain continued into August, showing that removal of the trusted-host lure did not immediately disable the broader operation.

The campaign also exposed a moderation challenge. Public Artifacts are designed for lightweight demonstrations and easy distribution, so a polished imitation can remain available long enough to capture users arriving from search results.

A fake Apple Support guide delivered MacSync through Terminal

Another campaign targeted a person searching Google for “Claude on Mac.” A sponsored result led to a public claude.ai/share conversation presented as an Apple Support installation guide.

The page lacked several warning signs commonly associated with phishing. Its hostname was genuine, its connection did not generate a certificate warning, and the content appeared inside Anthropic’s normal shared-conversation interface. The conversation was also labeled as having been shared by Apple Support, reinforcing the false attribution.

The instructions asked the victim to copy and paste a one-line curl command into macOS Terminal. Executing that command began a six-stage infection process that installed the MacSync information stealer.

MacSync collected high-value authentication and access material, including:

• Browser cookies and saved credentials
• macOS Keychain secrets
• Telegram session data
• SSH keys
• Cloud access keys

This creates risks beyond the initially infected Mac. Stolen cookies can permit session hijacking, while SSH and cloud keys may provide access to remote servers, development systems, or hosted infrastructure. Keychain theft can expose credentials belonging to multiple applications and services.

The user performs the decisive action manually. As a result, the technique may bypass assumptions that malware arrives only through a downloaded application or an exploited browser vulnerability.

Search poisoning pushed malicious ChatGPT and Grok advice upward

In December, attackers used public ChatGPT and Grok conversations to target people searching for ways to “clear disk space on macOS.”

They prepared conversations containing malicious troubleshooting steps, published them with the platforms’ sharing functions, and used search-engine-optimization poisoning to improve their visibility in Google results. The resulting URLs belonged to chatgpt.com and grok.com, making the instructions appear more credible than equivalent content on a newly registered website.

Instead of providing safe disk-cleanup guidance, the pages used a ClickFix-style technique. Victims were told to enter Terminal commands that ultimately installed the AMOS stealer.

ClickFix attacks shift part of the infection chain onto the victim. The malicious page may not contain an executable payload, and nothing necessarily downloads until the user follows the displayed instructions. This can reduce the value of controls that focus exclusively on malicious attachments and direct binary downloads.

Public AI conversations also fit naturally into search-driven support behavior. Users already consult AI services for installation advice, error resolution, and command-line help. Attackers can exploit that expectation without needing to imitate the entire platform.

This is feature abuse, not a conventional software vulnerability

The campaigns do not represent a flaw that can be resolved through a normal security update. There is no reported memory-corruption bug, authentication bypass, sandbox escape, or model compromise.

The attack path instead combines several legitimate systems:

1. An AI platform publishes a public Artifact or shared conversation.
2. Search optimization or a sponsored result places it in front of potential victims.
3. The genuine service domain lowers the victim’s suspicion.
4. The content recommends a download or command.
5. A redirect, shell command, or script retrieves the malware.
6. The installed stealer extracts credentials, sessions, and access keys.

Operationally, that chain can be severe despite the absence of a CVE. The relevant security question is not whether the AI provider’s code was exploited, but whether trusted publishing features can be used to persuade users to cross a security boundary.

The short lifespan of individual pages complicates investigation. Content may be removed before analysts collect it, while redirect domains and payload infrastructure continue operating. Defenders therefore need to preserve endpoint and network evidence rather than treating page removal as proof that the campaign has ended.

Defenders should focus on commands, execution, and persistence

Organizations cannot safely assume that content is trustworthy merely because it appears on an authentic AI-service domain. Additional verification should be required whenever AI-generated guidance requests a Terminal command, software download, credential action, or security-setting change.

Application allow-listing can prevent unauthorized binaries and scripts from running after a victim follows malicious instructions. Enterprises should also restrict or monitor commands launched from clipboard content, particularly in environments where employees routinely use AI tools for technical assistance.

Endpoint teams should investigate:

• Newly created scheduled tasks
• Unexpected modifications to antivirus exclusions
• Unapproved scripts or executables
• Command sequences copied from public support pages
• Activity following visits to shared AI conversations
• Credential, SSH-key, cloud-key, or session exposure on an infected device

There are no specific hashes, redirect domains, command strings, or other technical indicators disclosed for these campaigns. Detection must therefore emphasize behavior and context rather than a fixed indicator list.

Potentially malicious Artifacts and shared conversations should be reported to the platform provider quickly. However, defenders should also identify external domains contacted by affected endpoints and determine whether credentials or access keys require revocation.

The central lesson from Huntress’s findings on trusted AI-platform abuse is that an authentic domain proves where content is hosted, not who created it or whether its instructions are safe.