Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

What it is

Huntress' technical breakdown of FakeAgent, a July 21–22 2026 malvertising campaign delivering SectopRAT (initially attributed differently; reattributed to SectopRAT after HVNC was found in the .NET payload and C2 was traced through Ethereum BSC transactions). The summary states the vector; this page carries the concrete IOCs, the persistence mechanism, and the full delivery chain a defender needs to hunt.

How it works

The lure was a Bing sponsored ad pointing not to a fake domain but to a legitimate claude.ai public artifact (claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877), which had 7,100 page views before Anthropic removed it. The artifact's "Download" button redirected off-domain to claude.ai.download-app[.]us (registered May 9 2026) → downloading-api.it[.]com/html/claude/win, serving ClaudeDesktop.exe.

ClaudeDesktop.exe is a renamed JetBrains jcef_helper.exe, sideloading a tampered libcef.dll (hash mismatches public records; packed with VMProtect). The DLL references Ethereum contract 0xc1907d7be91f95903ad66d775c397302e7dd9228, whose function calls resolve to a payload at cache.dat, which installs the RAT.

flowchart TD
  A[Bing ad → legit claude.ai artifact] --> B[Download button redirect]
  B --> C[download-app.us → downloading-api.it.com]
  C --> D[ClaudeDesktop.exe<br/>renamed jcef_helper.exe]
  D --> E[sideloads tampered libcef.dll]
  E --> F[Ethereum contract → cache.dat]
  F --> G[SectopRAT]
  D --> H[DockerDesktop.exe<br/>scheduled task reinfect]

Preconditions / Affected

User searches for "Claude Desktop app," trusts the result because it sits on the real claude.ai domain, and executes the download. Trust is "disarmed" precisely because the origin domain is legitimate — the standard "check the URL bar" advice fails here.

What to do

Hunt for these specific artifacts the page names:

• Persistence: DockerDesktop.exe — an identical copy of the loader written to disk as a scheduled task that repeatedly reinfects the host. This is distinct from the initial ClaudeDesktop.exe and is the reinfection mechanism.
• Files: a libcef.dll whose hash does not match public CEF records, co-located with a jcef_helper.exe-derived binary.
• Network/IOCs: claude.ai.download-app[.]us, downloading-api.it[.]com, Ethereum contract 0xc1907d7be91f95903ad66d775c397302e7dd9228, staged payload cache.dat.
• Watch for the campaign's observed footprint: unexpected Defender exclusions and anomalous persistence alongside the executables above.

Caveats

Attribution was revised mid-analysis (updated to SectopRAT after HVNC discovery). VMProtect packing on libcef.dll makes deeper static analysis slow. Huntress notes some reimplementation work (AES and "SM5" emulation) was done with Claude Opus 4.8 — disclosed for transparency, not independently reproduced here.