The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

What it is

Huntress SOC's writeup of three real campaigns (observed over ~nine months) that abuse legitimate AI-platform features as malware delivery infrastructure, so the lure lives on a trusted domain. The concrete artifacts: a published Claude Artifact phishing page, a claude.ai/share conversation, and indexed chatgpt.com / grok.com shared conversations.

How it works

All three exploit the same trust boundary — attacker-controlled content hosted on a domain the user already trusts — reached via SEO poisoning or sponsored search:

• FakeAgent (July): Bing search for the Claude desktop app landed users on a public Claude Artifact impersonating Claude Desktop/Cowork. The "download" redirected through downloading-api[.]it[.]com to SectopRAT. Hit 29+ organizations. Anthropic vets artifacts only with a generic "Content is user-generated and unverified" banner.
• Fake Apple Support guide: a sponsored Google result led to a claude.ai/share/<id> conversation posing as an Apple Support install guide. It told the victim to paste a curl command into Terminal, launching a six-stage MacSync stealer kill chain that exfiltrated cookies, credentials, keychain secrets, Telegram sessions, and SSH/cloud keys.
• AI poisoning (December): a search for "Clear disk space on macOS" surfaced SEO-poisoned ChatGPT and Grok shared conversations giving ClickFix-style Terminal "cleanup" commands that fetched AMOS stealer.

flowchart TD
  A[Search / sponsored result] --> B{Lands on trusted AI domain}
  B -->|claude.ai artifact| C[Fake download link]
  B -->|claude.ai/share or chatgpt.com/grok.com| D[Paste command into Terminal]
  C --> E[downloading-api it com → SectopRAT]
  D --> F[curl kill chain → MacSync / AMOS]

Preconditions / Affected

• macOS users for the Terminal-based curl chains (MacSync, AMOS); Windows for the SectopRAT .exe.
• Relies on the user trusting the real claude.ai, chatgpt.com, or grok.com domain — no lookalike domain, no cert warning to tip them off.

What to do

The page states no formal mitigation list (the conclusion is truncated), but the durable IOC is explicit: the redirect domain downloading-api[.]it[.]com kept generating incidents through August even after Anthropic removed the artifact — block and hunt for it independently of the takedown. Treat pasted curl-into-Terminal instructions and .exe downloads sourced from AI-share URLs as suspect.

Caveats

• Malicious content is often removed by the provider within hours or days, so absence of the live page doesn't mean the campaign is over — the redirect infrastructure persists.
• The related fake OpenAI Codex download variant (also sponsored search → Terminal command → AMOS) is attributed to Cato Networks (August), not directly observed by Huntress.