{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Threat actors are weaponizing the trust inherent in AI platforms to deliver malware. Confirming that users have not executed commands from these emerging impersonation vectors is a high-priority exposure check."
      },
      "name": "AI-Impersonation Driven Script Execution and Data Theft",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1059.001",
        "attack.t1059.004",
        "attack.t1053.005",
        "attack.t1555",
        "attack.t1539",
        "attack.t1552"
      ],
      "series": {
        "slug": "the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms",
        "index": 2,
        "title": "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms",
        "total": 2
      },
      "related": [
        {
          "hunt": "ai-platform-mediated-malvertising-redirection",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple rule on 'curl | sh' is often too noisy for developer environments. This hunt uses a gated flow to correlate DNS-based redirection with rare persistence and specific sensitive file access, providing the context needed for high-confidence triage.",
      "coverage": [
        {
          "stage": "clipboard-command-execution",
          "steps": [
            "clipboard-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "stealer-persistence",
          "steps": [
            "rare-scheduled-persistence"
          ],
          "status": "covered"
        },
        {
          "stage": "sensitive-data-access",
          "steps": [
            "credential-theft-evidence"
          ],
          "status": "covered"
        },
        {
          "stage": "initial-access-seo-redirection",
          "reason": "This stage occurs on the search engine and browser before endpoint behavior begins.",
          "status": "out_of_scope"
        },
        {
          "stage": "malicious-payload-delivery",
          "reason": "Payload delivery is observed as the redirect DNS and resulting terminal command.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "AI Platform SEO Redirection",
            "slug": "initial-access-seo-redirection",
            "tactic": "initial-access",
            "techniques": [
              "T1566.002",
              "T1204.001"
            ],
            "observables": [
              "claude.ai",
              "chatgpt.com",
              "grok.com",
              "claude.ai/share",
              "sponsored search results",
              "Bing",
              "Google Search"
            ]
          },
          {
            "name": "AI-Themed Payload Delivery",
            "slug": "malicious-payload-delivery",
            "tactic": "execution",
            "techniques": [
              "T1204.001"
            ],
            "observables": [
              "downloading-api.it.com",
              "ClaudeDesktop.exe"
            ]
          },
          {
            "name": "Terminal and PowerShell Execution",
            "slug": "clipboard-command-execution",
            "tactic": "execution",
            "techniques": [
              "T1059.001",
              "T1059.004"
            ],
            "observables": [
              "curl",
              "powershell",
              "zsh",
              "bash",
              "Terminal",
              "Apple Support install guide lure",
              "Clear disk space lure"
            ]
          },
          {
            "name": "Malware Persistence",
            "slug": "stealer-persistence",
            "tactic": "persistence",
            "techniques": [
              "T1053.005"
            ],
            "observables": [
              "new scheduled tasks",
              "SectopRAT",
              "AMOS",
              "MacSync"
            ]
          },
          {
            "name": "Credential and Secret Theft",
            "slug": "sensitive-data-access",
            "tactic": "credential-access",
            "techniques": [
              "T1555",
              "T1539",
              "T1552"
            ],
            "observables": [
              "~/.ssh",
              "~/.aws",
              "~/Library/Keychains",
              "browser cookies",
              "Telegram sessions"
            ]
          }
        ],
        "summary": "Threat actors are utilizing SEO poisoning to lure victims into interacting with malicious artifacts and shared conversations on trusted AI platforms like Claude, ChatGPT, and Grok. These interactions lead to either the download of fake installers from malicious redirect domains or the execution of commands via Terminal and PowerShell that deploy credential stealers. The resulting malware, such as AMOS and MacSync, establishes persistence via scheduled tasks and exfiltrates sensitive credentials, cloud keys, and browser data."
      },
      "severity": "high",
      "rationale": "The lead query identifies users interacting with known redirect infrastructure. Forensics are then narrowed to those hosts to reduce noise from developers using similar terminal patterns.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder uses a trusted AI platform to trick a user into executing a terminal command from the clipboard, establishing persistence and stealing credentials.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Limit forensics to these hosts; usually the output of the DNS lead step."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "redirect_domains": {
          "from": {
            "ref": "huntress-ai-attack-surface",
            "kind": "article",
            "observed": "2026-08-27"
          },
          "type": "list[domain]",
          "default": [
            "downloading-api.it.com"
          ],
          "description": "Malicious redirect domains observed in AI-lure campaigns."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.huntress.com/blog/ai-attack-surface",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.huntress.com/blog/ai-attack-surface",
          "name": "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms"
        }
      ],
      "blind_spots": [
        {
          "id": "no-agent-coverage",
          "risk": "A host without an agent resolves the domain but remains invisible to forensics.",
          "question": "Are there hosts missing telemetry for DNS or process activity?",
          "requires": "endpoint agent on all systems"
        },
        {
          "id": "clipboard-content-visibility",
          "risk": "The hunt sees the execution but not the specific 'Apple Support' or 'Claude Cowork' lure that prompted it.",
          "stage": "clipboard-command-execution",
          "question": "What was the exact text the user copied from the AI platform?",
          "requires": "clipboard monitoring logs"
        },
        {
          "id": "encrypted-dns",
          "risk": "If the agent cannot intercept encrypted DNS, the initial lead may be missed.",
          "question": "Was the redirect domain resolved via DoH (DNS over HTTPS)?",
          "requires": "TLS inspection or proxy logs"
        }
      ]
    },
    "name": "AI-Impersonation Driven Script Execution and Data Theft",
    "description": "This hunt identifies 'ClickFix' attacks where victims follow malicious instructions from shared AI conversations or artifacts. The attacker uses the inherent trust in platforms like Claude and ChatGPT to bypass search safety, delivering commands that download stealers like AMOS or MacSync. The flow uses a gated approach: a cheap lead query identifies interaction with known redirect domains before opening forensic queries that examine terminal execution, rare scheduled jobs, and sensitive file access."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms",
          "index": 2,
          "title": "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms",
          "total": 2
        },
        "coverage": [
          {
            "stage": "clipboard-command-execution",
            "steps": [
              "clipboard-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "stealer-persistence",
            "steps": [
              "rare-scheduled-persistence"
            ],
            "status": "covered"
          },
          {
            "stage": "sensitive-data-access",
            "steps": [
              "credential-theft-evidence"
            ],
            "status": "covered"
          },
          {
            "stage": "initial-access-seo-redirection",
            "reason": "This stage occurs on the search engine and browser before endpoint behavior begins.",
            "status": "out_of_scope"
          },
          {
            "stage": "malicious-payload-delivery",
            "reason": "Payload delivery is observed as the redirect DNS and resulting terminal command.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An intruder uses a trusted AI platform to trick a user into executing a terminal command from the clipboard, establishing persistence and stealing credentials.",
        "blind_spots": [
          {
            "id": "no-agent-coverage",
            "risk": "A host without an agent resolves the domain but remains invisible to forensics.",
            "question": "Are there hosts missing telemetry for DNS or process activity?",
            "requires": "endpoint agent on all systems"
          },
          {
            "id": "clipboard-content-visibility",
            "risk": "The hunt sees the execution but not the specific 'Apple Support' or 'Claude Cowork' lure that prompted it.",
            "stage": "clipboard-command-execution",
            "question": "What was the exact text the user copied from the AI platform?",
            "requires": "clipboard monitoring logs"
          },
          {
            "id": "encrypted-dns",
            "risk": "If the agent cannot intercept encrypted DNS, the initial lead may be missed.",
            "question": "Was the redirect domain resolved via DoH (DNS over HTTPS)?",
            "requires": "TLS inspection or proxy logs"
          }
        ],
        "scoping_notes": "The lead query identifies users interacting with known redirect infrastructure. Forensics are then narrowed to those hosts to reduce noise from developers using similar terminal patterns.",
        "beyond_detection": "A simple rule on 'curl | sh' is often too noisy for developer environments. This hunt uses a gated flow to correlate DNS-based redirection with rare persistence and specific sensitive file access, providing the context needed for high-confidence triage."
      }
    },
    {
      "id": "dns-to-redirect",
      "type": "query",
      "label": "DNS to AI-lure redirect domains",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{redirect_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find any host resolving known malicious domains used as redirects from legitimate AI artifacts.",
        "expected_signal": "A hit indicates a user clicked a link within an AI platform; silence suggests no interaction with known indicators in this window."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "DNS to AI-lure redirect domains",
        "reads": [
          "device_hostname",
          "query_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{redirect_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A hit indicates a user clicked a link within an AI platform; silence suggests no interaction with known indicators in this window.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "evaluate-dns-lead",
      "type": "analytic",
      "label": "Evaluate DNS lead",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "dns-to-redirect"
        ],
        "objective": "Determine if the DNS activity indicates a suspicious redirect from an AI platform.",
        "description": "Determine if the resolution of the redirect domain warrants forensic investigation of the endpoint.",
        "max_iterations": 3,
        "expected_signal": "A verdict on whether the DNS activity matches the timing and process patterns of the AI impersonation campaign.",
        "success_criteria": "A suspicious or benign verdict per host citing the resolution event."
      },
      "parents": [
        {
          "id": "dns-to-redirect"
        }
      ]
    },
    {
      "id": "gate-on-lead",
      "type": "checkpoint",
      "label": "Gate forensics on DNS lead",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the evaluate-dns-lead verdict is suspicious for at least one host",
        "condition": "the evaluate-dns-lead verdict is suspicious for at least one host",
        "blind_spot": "no-agent-coverage",
        "confidence": "high",
        "description": "Open expensive forensic queries only for hosts showing suspicious DNS interaction.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "evaluate-dns-lead"
        }
      ]
    },
    {
      "id": "clipboard-execution",
      "type": "query",
      "label": "Suspicious shell execution patterns",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) IN ('curl', 'wget', 'bash', 'zsh', 'powershell.exe', 'pwsh', 'cmd.exe')) AND (LOWER(process_cmd_line) LIKE '%|%sh%' OR LOWER(process_cmd_line) LIKE '%iex%' OR LOWER(process_cmd_line) LIKE '%-enc%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify command execution matching the AI-lure pattern, such as shell downloads or encoded PowerShell commands.",
        "expected_signal": "Process rows showing an interpreter downloading and executing content directly from the command line."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Suspicious shell execution patterns",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) IN ('curl', 'wget', 'bash', 'zsh', 'powershell.exe', 'pwsh', 'cmd.exe')) AND (LOWER(process_cmd_line) LIKE '%|%sh%' OR LOWER(process_cmd_line) LIKE '%iex%' OR LOWER(process_cmd_line) LIKE '%-enc%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Process rows showing an interpreter downloading and executing content directly from the command line.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "rare-scheduled-persistence",
      "type": "query",
      "label": "Rare scheduled persistence",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT LOWER(job_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ASC",
        "surface": "hb_scheduled_job",
        "description": "Find new scheduled tasks that are unique to the scoped hosts, indicating persistence established by the malware.",
        "expected_signal": "A job seen on one or two hosts shortly after the lead interaction."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare scheduled persistence",
        "reads": [
          "device_hostname",
          "job_cmd_line",
          "time"
        ],
        "source": "hb_scheduled_job",
        "target": "endpoint",
        "content": "SELECT LOWER(job_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ASC",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A job seen on one or two hosts shortly after the lead interaction.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "job_cmd_line"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "credential-theft-evidence",
      "type": "query",
      "label": "Credential and sensitive file access",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/.ssh/%' OR LOWER(file_path) LIKE '%/.aws/%' OR LOWER(file_path) LIKE '%/library/keychains/%' OR LOWER(file_path) LIKE '%/telegram%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Detect access to SSH keys, cloud credentials, and browser keychains targeted by stealers.",
        "expected_signal": "File activity indicating a shell or unknown process reading sensitive directories."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_supports"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Credential and sensitive file access",
        "reads": [
          "device_hostname",
          "process_name",
          "file_path",
          "activity_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/.ssh/%' OR LOWER(file_path) LIKE '%/.aws/%' OR LOWER(file_path) LIKE '%/library/keychains/%' OR LOWER(file_path) LIKE '%/telegram%') AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "File activity indicating a shell or unknown process reading sensitive directories.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "kill-chain-triage",
      "type": "analytic",
      "label": "Kill chain triage",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint"
        ],
        "context": [
          "evaluate-dns-lead",
          "clipboard-execution",
          "rare-scheduled-persistence",
          "credential-theft-evidence"
        ],
        "objective": "Determine if the host shows a complete attack lifecycle following the AI redirect.",
        "description": "Correlate the DNS redirect, terminal execution, persistence, and data theft into a single intrusion verdict.",
        "max_iterations": 6,
        "expected_signal": "A malicious verdict for any host showing the complete lifecycle from the redirect to data theft.",
        "success_criteria": "A malicious verdict citing matching timestamps across DNS, process, and file surfaces."
      },
      "parents": [
        {
          "id": "clipboard-execution",
          "kind": "merge"
        },
        {
          "id": "rare-scheduled-persistence",
          "kind": "merge"
        },
        {
          "id": "credential-theft-evidence",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-triage",
      "type": "checkpoint",
      "label": "Route on triage verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the kill-chain-triage verdict is malicious for at least one host",
        "condition": "the kill-chain-triage verdict is malicious for at least one host",
        "blind_spot": "no-agent-coverage",
        "confidence": "high",
        "description": "Direct confirmed infections to isolation and others to review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "kill-chain-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Contain compromised host",
      "config": {
        "target": "endpoint",
        "description": "Isolate the host to prevent further data theft and exfiltration.",
        "instructions": "Isolate the host and notify the user to rotate all cloud and SSH keys from a different device.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-triage",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "remediation-review",
      "type": "task",
      "label": "Remediation and key rotation review",
      "config": {
        "assignee": "analyst",
        "description": "Confirm that all targeted credentials have been successfully rotated.",
        "instructions": "Review the file paths in credential-theft-evidence. Verify that the user has rotated SSH keys, AWS credentials, and browser-stored secrets accessed during the incident window."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "default"
        },
        {
          "id": "gate-on-lead",
          "branch": "on_unavailable"
        },
        {
          "id": "route-on-triage",
          "branch": "default"
        },
        {
          "id": "route-on-triage",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and any required tuning.",
        "instructions": "Document the hosts examined. If benign results were numerous, consider tuning the shell execution query to exclude known internal admin utilities."
      },
      "parents": [
        {
          "id": "gate-on-lead",
          "branch": "on_refutes"
        },
        {
          "id": "route-on-triage",
          "branch": "on_refutes"
        },
        {
          "id": "remediation-review"
        }
      ]
    }
  ]
}