--- analysis: A simple rule on 'curl | sh' is often too noisy for developer environments. This hunt uses a gated flow to correlate DNS-based redirection with rare persistence and specific sensitive file access, providing the context needed for high-confidence triage. blind_spots: - id: no-agent-coverage question: Are there hosts missing telemetry for DNS or process activity? requires: endpoint agent on all systems risk: A host without an agent resolves the domain but remains invisible to forensics. - id: clipboard-content-visibility question: What was the exact text the user copied from the AI platform? requires: clipboard monitoring logs risk: The hunt sees the execution but not the specific 'Apple Support' or 'Claude Cowork' lure that prompted it. stage: clipboard-command-execution - id: encrypted-dns question: Was the redirect domain resolved via DoH (DNS over HTTPS)? requires: TLS inspection or proxy logs risk: If the agent cannot intercept encrypted DNS, the initial lead may be missed. coverage: - stage: clipboard-command-execution status: covered steps: - clipboard-execution - stage: stealer-persistence status: covered steps: - rare-scheduled-persistence - stage: sensitive-data-access status: covered steps: - credential-theft-evidence - reason: This stage occurs on the search engine and browser before endpoint behavior begins. stage: initial-access-seo-redirection status: out_of_scope - reason: Payload delivery is observed as the redirect DNS and resulting terminal command. stage: malicious-payload-delivery status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: Threat actors are weaponizing the trust inherent in AI platforms to deliver malware. Confirming that users have not executed commands from these emerging impersonation vectors is a high-priority exposure check. methodology: model-assisted trigger: intel-report hypothesis: An intruder uses a trusted AI platform to trick a user into executing a terminal command from the clipboard, establishing persistence and stealing credentials. labels: - hunt - attack.t1059.001 - attack.t1059.004 - attack.t1053.005 - attack.t1555 - attack.t1539 - attack.t1552 name: AI-Impersonation Driven Script Execution and Data Theft parameters: lookback_days: default: '14' description: Days of history to examine. type: number redirect_domains: default: - downloading-api.it.com description: Malicious redirect domains observed in AI-lure campaigns. from: kind: article observed: '2026-08-27' ref: huntress-ai-attack-surface type: list[domain] scope_hosts: default: [] description: Limit forensics to these hosts; usually the output of the DNS lead step. type: list[host] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://www.huntress.com/blog/ai-attack-surface gates: - dry-run - lint - critic model: hb_google/gemini-3-flash-preview rationale: The lead query identifies users interacting with known redirect infrastructure. Forensics are then narrowed to those hosts to reduce noise from developers using similar terminal patterns. references: - name: 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' url: https://www.huntress.com/blog/ai-attack-surface related: - hunt: ai-platform-mediated-malvertising-redirection relation: follows scenario: stages: - name: AI Platform SEO Redirection observables: - claude.ai - chatgpt.com - grok.com - claude.ai/share - sponsored search results - Bing - Google Search slug: initial-access-seo-redirection tactic: initial-access techniques: - T1566.002 - T1204.001 - name: AI-Themed Payload Delivery observables: - downloading-api.it.com - ClaudeDesktop.exe slug: malicious-payload-delivery tactic: execution techniques: - T1204.001 - name: Terminal and PowerShell Execution observables: - curl - powershell - zsh - bash - Terminal - Apple Support install guide lure - Clear disk space lure slug: clipboard-command-execution tactic: execution techniques: - T1059.001 - T1059.004 - name: Malware Persistence observables: - new scheduled tasks - SectopRAT - AMOS - MacSync slug: stealer-persistence tactic: persistence techniques: - T1053.005 - name: Credential and Secret Theft observables: - ~/.ssh - ~/.aws - ~/Library/Keychains - browser cookies - Telegram sessions slug: sensitive-data-access tactic: credential-access techniques: - T1555 - T1539 - T1552 summary: Threat actors are utilizing SEO poisoning to lure victims into interacting with malicious artifacts and shared conversations on trusted AI platforms like Claude, ChatGPT, and Grok. These interactions lead to either the download of fake installers from malicious redirect domains or the execution of commands via Terminal and PowerShell that deploy credential stealers. The resulting malware, such as AMOS and MacSync, establishes persistence via scheduled tasks and exfiltrates sensitive credentials, cloud keys, and browser data. series: index: 2 slug: the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms title: 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # AI-Impersonation Driven Script Execution and Data Theft This hunt identifies 'ClickFix' attacks where victims follow malicious instructions from shared AI conversations or artifacts. The attacker uses the inherent trust in platforms like Claude and ChatGPT to bypass search safety, delivering commands that download stealers like AMOS or MacSync. The flow uses a gated approach: a cheap lead query identifies interaction with known redirect domains before opening forensic queries that examine terminal execution, rare scheduled jobs, and sensitive file access. ## dns-to-redirect Find any host resolving known malicious domains used as redirects from legitimate AI artifacts. ```sqlite target=endpoint role=scoping params=(lookback_days=lookback_days, redirect_domains=redirect_domains) ~~~yaml expected: A hit indicates a user clicked a link within an AI platform; silence suggests no interaction with known indicators in this window. reads: - device_hostname - query_hostname - process_name - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, query_hostname, process_name, time FROM hb_dns_activity WHERE instr(',' || '{{redirect_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') ``` ## evaluate-dns-lead ```agent target=hunter cite: required context: - dns-to-redirect max_iterations: 3 objective: Determine if the DNS activity indicates a suspicious redirect from an AI platform. success_criteria: A suspicious or benign verdict per host citing the resolution event. tools: - endpoint ``` ## gate-on-lead if~: "the evaluate-dns-lead verdict is suspicious for at least one host" (confidence: high, judge=hunter) then: → parallel-forensics indeterminate: → remediation-review unavailable: → remediation-review (blind_spot: no-agent-coverage) else: → close-out ## parallel-forensics parallel: - → clipboard-execution - → rare-scheduled-persistence - → credential-theft-evidence join: → kill-chain-triage ## clipboard-execution Identify command execution matching the AI-lure pattern, such as shell downloads or encoded PowerShell commands. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: Process rows showing an interpreter downloading and executing content directly from the command line. reads: - device_hostname - process_name - process_cmd_line - user_name - time silence: not_evidence_of_absence source: hb_process_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(process_name) IN ('curl', 'wget', 'bash', 'zsh', 'powershell.exe', 'pwsh', 'cmd.exe')) AND (LOWER(process_cmd_line) LIKE '%|%sh%' OR LOWER(process_cmd_line) LIKE '%iex%' OR LOWER(process_cmd_line) LIKE '%-enc%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## rare-scheduled-persistence Find new scheduled tasks that are unique to the scoped hosts, indicating persistence established by the malware. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: A job seen on one or two hosts shortly after the lead interaction. prevalence: by: device_hostname key: - job_cmd_line rare_below: 3 reads: - device_hostname - job_cmd_line - time silence: not_evidence_of_absence source: hb_scheduled_job verified: dry-run verified_at: '2026-09-20' ~~~ SELECT LOWER(job_cmd_line) AS cmd, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY cmd HAVING hosts <= 3 ORDER BY hosts ASC ``` ## credential-theft-evidence Detect access to SSH keys, cloud credentials, and browser keychains targeted by stealers. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: File activity indicating a shell or unknown process reading sensitive directories. reads: - device_hostname - process_name - file_path - activity_name - time silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, process_name, file_path, activity_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%/.ssh/%' OR LOWER(file_path) LIKE '%/.aws/%' OR LOWER(file_path) LIKE '%/library/keychains/%' OR LOWER(file_path) LIKE '%/telegram%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## kill-chain-triage ```agent target=hunter cite: required context: - evaluate-dns-lead - clipboard-execution - rare-scheduled-persistence - credential-theft-evidence max_iterations: 6 objective: Determine if the host shows a complete attack lifecycle following the AI redirect. success_criteria: A malicious verdict citing matching timestamps across DNS, process, and file surfaces. tools: - endpoint ``` ## route-on-triage if~: "the kill-chain-triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → contain-host indeterminate: → remediation-review unavailable: → remediation-review (blind_spot: no-agent-coverage) else: → close-out ## contain-host ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host and notify the user to rotate all cloud and SSH keys from a different device. ``` → remediation-review ## remediation-review ```manual target=analyst Review the file paths in credential-theft-evidence. Verify that the user has rotated SSH keys, AWS credentials, and browser-stored secrets accessed during the incident window. ``` → close-out ## close-out ```manual target=analyst Document the hosts examined. If benign results were numerous, consider tuning the shell execution query to exclude known internal admin utilities. ``` → end