Malicious Artifact Hosted on a Legitimate AI Vendor Domain (FakeAgent Delivery Chain)
Attackers abuse the user-content features of AI platforms — shared chats, published artifacts, hosted pages — to host lure pages on the vendor's own trusted domain. The page then redirects visitors to a look-alike desktop app installer hosted on attacker infrastructure, which installs malware.
How the attack works
An attacker publishes content on an AI vendor's official platform (a shared chat, artifact, or space), so the lure page's URL looks legitimate and passes domain and TLS checks. That page links out to a download hosted on a lookalike domain that embeds the real vendor's domain name inside a subdomain, tricking casual URL inspection. The download is a fake vendor desktop installer (observed name: ClaudeDesktop.exe) that includes a trojanised helper binary (jcef_helper.exe) which side-loads a malicious DLL (libcef.dll). This chain ultimately installs the SectopRAT remote-access trojan, and attackers have been observed adding AV exclusions and scheduled-task persistence for the dropped binary, running it from a user-writable folder.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- ba6e8a6d-2167-465d-9d0d-d05686b7663d
- Severity
- High
Why it matters
A user who trusts the vendor's domain and downloads what looks like an official desktop app instead installs a remote-access trojan, giving the attacker persistent access to the compromised machine. Because the lure sits on real vendor infrastructure, standard domain-reputation and allowlist defenses do not catch it.
What you can do
- →Do not treat 'hosted on the vendor's domain' as proof that a linked download is genuine; check where the actual binary is served from, not just the landing page.
- →Verify desktop app installers against the vendor's official download page and published checksums instead of links found in shared chats, artifacts, or community-hosted content.
- →Watch for installer filenames matching known desktop clients that are followed by unusual DLL side-loading, new AV exclusions, or scheduled-task persistence.
- →Restrict execution of downloaded installers from user-writable directories and require IT-vetted software distribution for desktop AI clients.
Known benign look-alikes
- Threat-intelligence and incident-response content that quotes FakeAgent indicators in live (non-defanged) form: a report writing claude.ai.download-app.us instead of claude[.]ai[.]download-app[.]us will match Layer 1 and Layer 5.
- Security tooling, sandboxes and detection-engineering pipelines that deliberately fetch or replay the malicious artifact URL and the fake installer for analysis.
- Internal enterprise software portals that publish an in-house repackaged build named like a vendor desktop client (for example an IT-distributed ClaudeDesktop.exe) and fetch it over HTTP. Layer 2 cannot distinguish an authorised repackage from an impersonating one.
- Malware-analysis notes and blue-team runbooks that reproduce the persistence commands verbatim (Add-MpPreference exclusions, schtasks entries naming a vendor desktop binary) will match Layer 4.
- A legitimate published artifact or shared chat that happens to link to a genuine software installer (for example an artifact documenting a release that links to a vendor .msi) will match Layer 3, which only requires co-occurrence of a UGC URL and an executable URL.
- Virtual-hosted object-storage URLs whose bucket name is itself a vendor apex domain (docs.mistral.ai.s3.amazonaws.com, claude.ai.storage.googleapis.com) satisfy Layer 1's shape: the vendor apex genuinely sits in a subdomain label of a registrable domain the vendor does not control. Layer 1 cannot separate a vendor-operated bucket from an attacker-registered one, because at the URL level they are the same construction.
- Layer 4 is scoped to field tool_args, so blue-team prose only reaches it when the text is inside a tool invocation. In SKILL.md scanning every field collapses to the document body, but this rule declares scan_target: runtime and carries 6 conditions, so the engine's skill-context compound gate requires 2 matching conditions - a runbook that trips Layer 4 alone stays silent there.