Ten Minutes to Containment: How Agentic MXDR Scoped a Fake Claude Desktop Intrusion

This campaign leveraged malvertising on Bing to distribute trojanized Claude Desktop installers hosted on legitimate Anthropic infrastructure. The attack chain included DLL sideloading via Java Chromium Embedded Framework, Microsoft Defender tampering, and scheduled task persistence disguised as Microsoft Edge updates. Command-and-control infrastructure used blockchain-based EtherHiding techniques. An automated threat hunting agent correlated queries across multiple kill chain phases, enabling rapid detection and containment within ten minutes. The intrusion delivered SectopRAT malware capable of infostealing and remote desktop access, requiring full endpoint reimaging and credential resets to remediate.

The intrusion results in deployment of SectopRAT malware, which compromises endpoint security by stealing information and providing remote desktop access to attackers. The attack chain's tampering with Microsoft Defender and use of scheduled task persistence disguised as legitimate updates complicates detection and removal. Affected systems require full reimaging and credential resets to fully remediate the compromise.

No official patch or fix is available for this campaign as it is an active malware intrusion rather than a software vulnerability. Mitigation relies on rapid detection and response capabilities, including automated threat hunting agents that correlate multiple kill chain phases and provide confidence-scored findings for quick validation. Organizations should monitor for indicators such as the domain neeitoerw.my and IP 153.75.84.173, and be vigilant for scheduled tasks masquerading as Microsoft Edge updates. Full endpoint reimaging and credential resets are necessary to remediate infected systems.