Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT

Between July 21-22, 2026, a sophisticated malvertising campaign compromised 29 organizations by leveraging sponsored ads on Bing that led to a malicious Claude Artifact hosted on the authentic Claude.ai domain. This artifact redirected users to attacker-controlled infrastructure distributing a fake ClaudeDesktop.exe file containing SectopRAT malware. SectopRAT employed multiple advanced evasion techniques including VMProtect packing, GPU-based virtual machine detection, and DirectX shader-based payload decryption. Its command-and-control infrastructure used EtherHiding, embedding C2 addresses within Ethereum blockchain transactions to avoid takedown efforts. The malware exfiltrated credit card data, credentials, browser information, and personal files. Analysis linked this campaign to prior activity from December 2025 and to infrastructure associated with Operation Endgame and StealC distribution.

The campaign resulted in the compromise of 29 organizations, with attackers gaining access to sensitive data such as credit card information, user credentials, browser data, and personal files. The use of advanced anti-analysis and evasion techniques increased the difficulty of detection and mitigation. The resilient C2 infrastructure leveraging blockchain technology further complicates takedown efforts, potentially prolonging attacker control and data exfiltration.

No official patch or vendor advisory is available for this threat as it involves a malware campaign rather than a software vulnerability. Mitigation should focus on user awareness to avoid downloading software from untrusted or suspicious advertisements, especially those impersonating legitimate services. Network defenses should monitor for indicators of compromise related to SectopRAT and blockchain-based C2 communications. Endpoint detection solutions capable of identifying VMProtect packing and DirectX shader-based decryption techniques may aid in detection. Given the advanced evasion techniques, layered security controls and threat intelligence updates are recommended.