Attackers are no longer just impersonating AI tools from random lookalike domains. In the FakeAgent campaign reported by Huntress and covered by BleepingComputer, the lure started with sponsored Bing search results for a Claude desktop app and led victims through a public Claude artifact hosted on Anthropic’s legitimate domain before delivering a fake ClaudeDesktop.exe installer.

That trust chain matters. A user searching for a productivity tool sees a familiar AI brand, a sponsored result, and a real vendor domain. By the time the executable lands on the endpoint, the security problem is no longer “user clicked a sketchy link.” It is brand trust, search advertising, public-content hosting, DLL sideloading, and endpoint execution all collapsing into one kill chain.

What was reported

According to Huntress, the campaign hit 29 organizations between July 21 and July 22, 2026. The malicious artifact reportedly received thousands of views before it was removed. Victims were redirected to external download infrastructure serving a fake Claude Desktop installer.

BleepingComputer reported that the installer used a legitimate JetBrains Chromium component and a malicious libcef.dll to sideload SectopRAT, also known as ArechClient2. Huntress also observed persistence through a fake DockerDesktop.exe scheduled task and additional staging components using anti-analysis techniques.

The campaign is especially notable because the malware did not rely on a simple hardcoded command-and-control path. Researchers described infrastructure discovery through Ethereum BNB Smart Chain transactions, commonly called EtherHiding, which gives operators a more resilient way to rotate C2 locations.

Why this matters for SMBs and government contractors

Small businesses and cleared-adjacent contractors are adopting AI tools fast, often before software procurement and endpoint-control processes catch up. That creates a predictable opening: attackers can advertise fake installers for tools employees already want, abuse trusted hosting features, and then rely on signed or legitimate binaries to make the infection look routine.

For government contractors, the risk is bigger than one infected workstation. A remote access trojan with information-stealing and hidden remote-control capability can expose browser sessions, VPN credentials, cloud consoles, collaboration apps, password managers, project files, and proposal data. In a small environment, one workstation can become the bridge into email, identity, file shares, and customer-facing systems.

Defensive takeaways

  • Stop treating sponsored search as trusted software distribution. Train users to navigate directly to vendor download pages or approved internal software portals. Paid search results should not be the source of truth for installers.
  • Control AI desktop app installation. Maintain an approved software list for AI tools, including official download URLs, publisher names, expected install paths, and known update mechanisms.
  • Monitor for lookalike execution paths. Hunt for unexpected binaries named after popular tools, especially ClaudeDesktop.exe, DockerDesktop.exe, or browser-framework components executing from user-writable directories.
  • Detect DLL sideloading patterns. Alert when signed third-party executables load unusual adjacent DLLs from temporary, downloads, roaming profile, or non-standard application paths.
  • Watch scheduled tasks created by user-space installers. Persistence that imitates legitimate update services should be reviewed quickly, especially when paired with Defender exclusions or newly dropped DLLs.
  • Add crypto/Web3 C2 awareness to egress reviews. EtherHiding does not mean every blockchain request is malicious, but endpoints that suddenly query blockchain-related services during an installer chain deserve scrutiny.
  • Preserve evidence before cleanup. If an endpoint ran the fake installer, collect process trees, scheduled tasks, browser download history, files in roaming profile paths, Defender event logs, and outbound network telemetry before wiping artifacts.

Bulwark Black assessment

FakeAgent is the kind of campaign that will keep working because it abuses normal behavior: users search for a tool, click a sponsored result, land on a trusted domain, and install what looks like productivity software. The right control is not just “more awareness training.” It is a tighter software acquisition path backed by endpoint telemetry that can catch sideloading, suspicious scheduled tasks, and unexpected remote-access tooling.

For SMBs and government contractors, the practical move is to build a short approved-AI-tools standard now: where installers come from, who can approve them, what telemetry confirms legitimacy, and what gets blocked by default. AI adoption is not slowing down. Neither is attacker interest in using AI brand trust as the front door.

Original reporting: BleepingComputer. Primary technical analysis: Huntress.