HuntressPublished
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT
By Michael Tigges
Excerpt
Update: We have updated the malware attribution for this blog to SectopRAT due to the presence of HVNC in the .NET payload after closer inspection of the related Command and Control services revealed in the Ethereum BSC transactions.
Background
Between July 21 and July 22, 2026, Huntress' Security Operations Center (SOC) lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe . The attacks had one common denominator: victi…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Huntress on huntress.com.
More from Huntress4
- Up a Creek Without a Command Line: Mapping an Akira Ransomware AttackHuntress · Published 6 Oct
- Dissecting CrashFix: KongTuke's New ToyHuntress · Published 16 Jan
