AI adoption is changing not only how organizations work, but also how attackers exploit user trust. A recent malvertising campaign shows how employees searching for popular AI desktop tools can be redirected through apparently legitimate infrastructure and end up installing a remote access trojan.

The campaign affected at least 29 organizations over a two-day period and used a fake Claude Desktop installer to deploy SectopRAT, a .NET-based remote access trojan capable of stealing browser data, credentials, files, credit card information, cookies, autofill data, and other sensitive user information.

For CISOs, CIOs, security architects, and risk leaders, the lesson is clear: trusted domains, search results, and familiar software names can no longer be treated as sufficient indicators of safety. Security programs must account for malvertising, user-generated content abuse, signed-binary abuse, DLL sideloading, and resilient command-and-control techniques that are increasingly common in commodity and targeted malware campaigns.

How the Campaign Worked

The attack began with a routine user action: searching the web for a desktop application associated with a widely used AI platform. Sponsored search results included several malicious advertisements. One result was especially convincing because it led first to a public artifact hosted on the legitimate AI provider’s domain.

Public artifacts are user-generated pages or files that can be created and shared publicly. In this case, the artifact was designed to look like a legitimate desktop application download page. Although the page carried a notice that the content was user-generated and unverified, the use of a well-known domain likely reduced user suspicion.

When victims clicked the download button, they were redirected to attacker-controlled infrastructure, including domains resembling legitimate application download sites. The user then downloaded and executed a file named ClaudeDesktop.exe.

Security implication: The initial trust signal was not the final download domain, but the fact that the user’s journey began on a legitimate, recognizable service. This is precisely why malvertising and abuse of trusted platforms remain difficult to manage through user awareness alone.

Before takedown, the malicious public artifact had received approximately 7,100 page views, showing how quickly a campaign can scale when combined with paid search placement and a convincing software lure.

From Fake Installer to Remote Access Trojan

The downloaded ClaudeDesktop.exe was not a legitimate desktop application. It was part of an attack chain that used legitimate-looking binaries and DLL sideloading to execute malicious code.

Two primary executables appeared in the campaign:

• ClaudeDesktop.exe, used to download and stage the initial payload.

• DockerDesktop.exe, written to disk as part of persistence and used to repeatedly reinfect the system.

These files were associated with a legitimate Chromium Embedded Framework component, specifically a JetBrains jcef_helper.exe-related binary. The attackers abused this trusted context through DLL sideloading.

DLL sideloading occurs when an application loads a malicious dynamic link library from a location in its search path. If the parent executable is trusted or signed, malicious code can execute under the appearance of a legitimate process. In this campaign, the malicious payload was placed in a modified libcef.dll, a file name normally associated with Chromium Embedded Framework deployments.

This matters for enterprise defense because DLL sideloading often blends into normal application behavior. In large environments, especially those with many development tools, business applications, SaaS clients, and self-updating desktop software, defenders may see many legitimate binaries loading adjacent DLLs. Distinguishing benign software behavior from abuse requires endpoint telemetry, file reputation, behavioral detection, and effective alert triage.

Anti-Analysis and Resilient Command and Control

The malware used several techniques designed to slow down investigation and evade sandbox analysis.

One component was packed with VMProtect, a commercial software protection tool often abused by attackers to make malware difficult to reverse engineer. VMProtect can substantially increase the time and expertise required to understand what a binary does.

The malware also referenced Ethereum blockchain contracts. These were not used for cryptocurrency transactions in the conventional sense. Instead, they supported a technique known as EtherHiding, where malware retrieves command-and-control information from blockchain transaction data.

This provides attackers with a resilient way to rotate infrastructure. Rather than hardcoding a single command-and-control server into the malware, the operator can post updated information through blockchain transactions. This makes takedown and disruption more difficult because defenders cannot simply remove one web server or block one domain.

The investigated payload ultimately revealed command-and-control infrastructure associated with SectopRAT, including a live C2 address at 2.24.131[.]246.

Key point: Blockchain-based C2 does not require the victim organization to interact with cryptocurrency services in a business context. It can appear simply as outbound network behavior from infected endpoints.

GPU-Based Evasion and Payload Decryption

A second persistence path wrote a file to:

%APPDATA%\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe

This file used another legitimate signed application as a cover, in this case an IBM SPSS-related binary. Again, the attackers relied on DLL sideloading, this time through a modified tempdir.dll.

This component implemented several anti-analysis controls, including a GPU-based virtual machine check. The malware examined DirectX Graphics Interface adapters and looked for indicators associated with virtual machines, such as QEMU or VMware identifiers. It also checked for limited video RAM allocation below 1 GB and performed a small compute shader timing check. If the environment appeared to be a sandbox or emulator, the malware could refuse to execute.

The payload was stored on disk as appcfg.dat. Rather than using a traditional CPU-based decryption routine, the malware used a compiled DirectX shader to decrypt the payload through the graphics interface. This is significant because many defensive workflows focus on CPU-based cryptographic calls, memory scanning, or standard unpacking patterns.

GPU-assisted payload handling complicates analysis because standard reverse engineering tools are not always designed to decompile or emulate shader bytecode effectively. In this case, the decrypted content included both a standard portable executable and a heavily obfuscated .NET assembly.

The .NET payload contained strings and behavior consistent with SectopRAT, including references to:

• Browser logins

• Cookies

• Autofill data

• Credit card data

• Chromium key theft

• FTP clients

• Discord

• Messaging clients

• File and password theft

Why This Matters for Security Leaders

This campaign is not only a malware story. It is a governance, resilience, and control-design issue.

Organizations across finance, healthcare, manufacturing, technology, retail, energy, public sector, and other regulated sectors are rapidly adopting AI tools. Employees search for desktop applications, browser extensions, plugins, productivity clients, developer tools, and integrations. Attackers understand this demand and are exploiting it through advertising ecosystems, lookalike domains, trusted user-generated platforms, and familiar brand names.

The risks include:

• Credential compromise: Browser credential theft can expose SaaS, cloud, email, VPN, developer platforms, and privileged portals.

• Fraud and account takeover: Financial services, retail, insurance, and customer-facing platforms face elevated risk if stolen credentials are reused.

• Data exposure: Healthcare records, customer data, intellectual property, contracts, and regulated information may be accessed through compromised endpoints.

• Operational disruption: Remote access trojans can serve as initial access for ransomware, lateral movement, or data extortion.

• Compliance exposure: Unauthorized access to systems containing regulated data can trigger notification, audit, and reporting obligations.

• Third-party risk amplification: Compromised endpoints used by vendors, MSPs, developers, or contractors can create downstream exposure.

Executive takeaway: The campaign demonstrates that endpoint compromise can originate from ordinary software discovery behavior, not only from phishing emails or malicious attachments.

Defensive Priorities

Security teams do not need to block all AI adoption to reduce this risk. The goal is to govern software acquisition, strengthen endpoint controls, and reduce the chance that users install untrusted binaries from search results.

Prioritize the following controls:

• Control software installation paths. Require approved distribution channels for AI tools, developer utilities, collaboration clients, and browser extensions.

• Restrict local administrator rights. Limit the ability of users to install software that can establish persistence or load malicious DLLs.

• Monitor for DLL sideloading patterns. Pay attention to signed binaries loading unusual adjacent DLLs, especially from user-writable paths.

• Detect suspicious persistence. Investigate scheduled tasks, unusual files under roaming profile paths, and masquerading under update-related directories.

• Inspect outbound connections. Monitor suspicious outbound traffic to newly registered domains, blockchain-related endpoints, and unapproved infrastructure.

• Harden browser credential storage. Reduce reliance on unmanaged browser password storage where enterprise password managers and conditional access controls are available.

• Review sponsored-result exposure. Educate users that sponsored search results are not inherently trustworthy, especially for software downloads.

• Block known indicators. Add relevant hashes, domains, and IP indicators to detection and blocking systems where appropriate.

• Validate AI tool procurement. Provide employees with an internal catalog of approved AI applications, download links, and usage guidance.

Indicators for Detection and Hunting

Security teams should review telemetry for the following indicators associated with this campaign:

• Malicious artifact path: claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877

• Redirect domain: download-app[.]us

• Backup domain: 5ca8758c-02d0-4a72-89c8-d468b66dda41[.]com

• SectopRAT C2: 2.24.131[.]246

• SectopRAT BSC contract: 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228

• Stager BSC contract: 0xc1907d7be91f95903ad66d775c397302e7dd9228

• SHA256 tempdir.dll: 1cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bb

• SHA256 libcef.dll: 26bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394a

• SHA256 embedded SectopRAT payload: 1fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664

Historical C2 infrastructure associated with related activity included multiple IP addresses across 2025 and 2026, suggesting a longer-running operator pattern rather than a one-off campaign.

Practical Takeaway

The campaign illustrates a broader shift in endpoint risk: attackers are abusing the same digital trust patterns that employees rely on to work quickly. A legitimate domain, a familiar product name, a signed binary, or a top search result is no longer enough to establish safety.

Security leaders should respond by tightening software governance, improving endpoint detection for sideloading and persistence, and giving users safe, approved ways to obtain AI tools. The objective is not to slow adoption, but to ensure that business enthusiasm for AI does not become an unmanaged initial-access path into critical systems.