Attackers Abuse Claude, ChatGPT Links to Spread Malware

Threat actors are turning trusted AI platforms such as Claude and ChatGPT into an attack surface by abusing legitimate share links, public mini-apps, and sponsored search placements to deliver malware, according to new reporting from Huntress Labs. Over the past nine months, the Huntress Security Operations Center, or SOC, has tracked incidents in which attackers weaponized shareable AI content, public mini-apps on AI platforms, and sponsored search placement to target AI users and deliver malware. The bigger day-to-day risk, Huntress says, comes from attackers abusing the AI features people already trust and rely on, rather than from direct attacks on the AI companies themselves or on the underlying language models.

The abused features are all real parts of widely used AI services. Claude Artifacts are pieces of content that the Claude assistant generates and displays in a chat preview pane, and users can publish them through a public link. The claude.ai/share links are shareable URLs created when someone publishes a Claude conversation; those links can surface in search engines when they are posted to crawlable places like forums or social media. Shared ChatGPT and Grok conversations are public, indexable conversations hosted on chatgpt.com and grok.com, and they can rank for troubleshooting searches. Each of these pages sits inside a trust boundary. A visitor recognizes the platform, the branding, and the surrounding content, so malicious instructions or downloads look legitimate even when they are not.

One campaign named FakeAgent illustrates how a public Artifact can become a malware delivery page. In July, Huntress saw FakeAgent hit more than 29 organizations. It started with a malicious Claude Artifact hosted on the real claude.ai domain. Because public Artifacts are meant for lightweight demos and get minimal vetting from Anthropic beyond a generic disclaimer, attackers built a convincing fake Claude Desktop download page inside that Artifact. Victims who searched Bing for the Claude desktop app landed on the fake page and clicked what looked like a legitimate download link. Instead, they were redirected to an external domain that delivered the SectopRAT malware, a remote access tool that gives attackers control over an infected machine. Huntress reported the Artifact and Anthropic removed it by July 22, but incidents tied to the same redirect domain continued into August.

A separate incident abused a claude.ai/share link in a different way. A victim searching Google for "Claude on Mac" clicked a sponsored result that led to a claude.ai/share link posing as an Apple Support install guide. Because the page lived on Anthropic's own domain, it carried none of the usual red flags: no lookalike URL, no certificate warning. The fake guide instructed the victim to paste a curl command into Terminal, the text-based program on a Mac where typed commands run directly. That command started a six-stage chain that deployed the MacSync stealer, a type of malware that collects private data from the infected computer. Huntress reports the MacSync stealer harvested cookies, credentials, keychain secrets, Telegram sessions, and SSH and cloud keys.

A third pattern targets AI-generated troubleshooting advice itself. In December, a routine search for "clear disk space on macOS" surfaced high-ranking ChatGPT and Grok conversations that gave ClickFix-style instructions instead of real fixes. ClickFix is a scam style that shows fake instructions and tells the user to run a command or click a "fix" button, but the command actually installs malware. Attackers had crafted the conversations, clicked the share button to generate a public URL on the platform's trusted domain, and used SEO poisoning to push the link to the top of Google's results. SEO poisoning means tricking search engines into ranking malicious pages near the top. Because the links lived on real chatgpt.com and grok.com domains, victims trusted the advice and ran the suggested Terminal commands, which delivered the AMOS stealer, another data-stealing malware family.

None of these attacks broke through the AI platforms' own security controls, Huntress stresses. Instead, they exploited the trust users place in familiar brands and real domains. Defenders should treat clipboard-driven execution and AI-assisted troubleshooting as security risks. Clipboard-driven execution means running commands that were copied and pasted from a web page. Huntress recommends restricting script execution from the clipboard and enforcing application allow-listing, a security setting that only lets approved programs run on a device. Security teams should also watch for new scheduled tasks and antivirus exclusion changes, and train users to spot ClickFix-style lures. Reporting suspicious AI-hosted content to the platform vendor quickly can reduce how long a campaign stays active. For administrators looking to add a network-level control point, AEU DNS provides private, secure DNS resolution.

These campaigns tend to be short-lived, often running only for hours or days before a provider pulls the content down, but that is enough time to trick victims before getting caught. Fast reporting and layered controls can shrink the window attackers get to exploit them. Website owners and everyday users should treat any web page, even one on a familiar domain, as untrusted when it asks them to run a command or download a file.