Huntress: The Bigger Risk Isn't the AI Model, It's the Trust Around It
New research from Huntress, covered by BleepingComputer, argues that the more pressing day-to-day threat from AI isn't attacks on the models themselves — it's attackers abusing the AI features people already trust. Huntress's Security Operations Center documented several campaigns from December 2025 through August 2026 in which threat actors hosted malicious content directly on legitimate AI platform domains — claude.ai, chatgpt.com, and grok.com — turning shareable, publicly indexable AI features into a distribution channel for malware.
The common thread is a trust boundary: victims land on the real platform domain, with real branding and no certificate warning, so instructions or "downloads" served from inside a chat interface read as legitimate. Huntress notes these campaigns typically run only hours or days before the platform pulls the content, but that window is enough to rack up victims — and echoes a related campaign Labs covered earlier this week, where Anthropic separately disclosed abuse of Claude for large-scale secrets mining, a different technique entirely from the content-hosting abuse described here.
The Techniques Huntress Documented
| Technique | How It Works |
|---|---|
| Weaponized Claude Artifacts | In a campaign Huntress calls FakeAgent (July 2026), attackers published a convincing fake Claude Desktop download page as a public Claude Artifact, hosted on the real claude.ai domain. Victims searching Bing for the Claude app landed on it and were redirected to an external site pushing SectopRAT malware. Huntress says the campaign hit 29+ organizations; Anthropic removed the Artifact by July 22, though incidents tied to the same redirect domain continued into August. |
| Weaponized shared AI conversation links | On claude.ai/share, attackers built a fake "Apple Support install guide" that surfaced when a victim searched for "Claude on Mac." Because the link lived on the genuine claude.ai domain, there was no lookalike spelling or certificate warning to catch. It instructed the victim to paste a curl command into Terminal, triggering a six-stage kill chain that deployed the MacSync stealer — harvesting cookies, credentials, keychain secrets, Telegram sessions, and SSH and cloud keys. |
| SEO-poisoned / sponsored search results | Bing and Google searches for ordinary troubleshooting queries ("Claude on Mac," "clear disk space on macOS") were used to funnel victims toward the malicious Artifacts and shared conversations rather than official help content, exploiting the platforms' own search ranking and, in related activity, sponsored ad placements. |
| ClickFix-style lures | Highly ranked shared conversations on chatgpt.com and grok.com — surfaced by a December search for "Clear disk space on macOS" — gave fake troubleshooting "advice" that walked victims through pasting a terminal command, delivering the AMOS (Atomic Stealer) infostealer. This is the classic ClickFix pattern: a fabricated fix that requires the victim to run an attacker-supplied command themselves. |
Huntress also flags related activity tracked separately by Trend Micro: a sustained Google Ads malvertising campaign impersonating at least six AI developer brands — including ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, and Claude — that later pivoted to abuse claude.ai's shared-chat feature to host its ClickFix instructions. Anthropic banned the accounts involved, disabled the malicious shared conversations, and says it is rolling out additional abuse mitigations for shared chats.
Why This Matters
None of these campaigns required breaking Claude, ChatGPT, or Grok themselves — they required only that a feature meant for lightweight sharing (Artifacts, shared conversation links) receives minimal vetting before it goes live and public. That is a durable gap: any platform that lets users publish content to a trusted, crawlable, first-party domain is a candidate for the same abuse, and it will keep recurring until vendors add stronger pre-publication screening.
Practical takeaways:
- Never paste a terminal or PowerShell command from a webpage, chat, or "support" instructions you didn't seek out from an official source — this is the single tell across every campaign above (ClickFix, in essence, asks the victim to be their own malware installer).
- A URL on the real AI platform domain is not proof of legitimacy. Artifacts and shared-conversation links inherit the domain's trust without inheriting the vendor's editorial review — treat unsolicited "download" or "fix" pages hosted there with the same skepticism as any other unknown link.
- Restrict clipboard-driven script execution where feasible, and enforce application allow-listing on endpoints, particularly for macOS fleets that are a repeat target across these campaigns.
- Monitor for new scheduled tasks, LaunchAgents, and antivirus/EDR exclusion changes — common persistence and evasion steps once a ClickFix payload lands.
- Report suspicious AI-hosted content to the vendor immediately. Because these campaigns are short-lived by nature, fast reporting is one of the few levers that meaningfully shrinks the exposure window.
- Security awareness training should explicitly call out AI platforms as a phishing and malware vector now, not just email and lookalike domains.
Huntress's full research is available on its blog; BleepingComputer's coverage summarizes the FakeAgent, MacSync, and ClickFix campaigns cited above.