{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Threat actors weaponize the inherent trust in legitimate AI platforms to bypass domain reputation filters. Identifying the specific chain from a trusted domain to a shell execution or malicious redirect is critical for detecting initial access in the current AI attack surface." }, "name": "AI Platform Mediated Malvertising and Redirection", "type": "investigation", "labels": [ "hunt", "attack.t1566.002", "attack.t1204.001" ], "series": { "slug": "the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms", "index": 1, "title": "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms", "total": 2 }, "related": [ { "hunt": "browser-paste-terminal-execution", "reason": "The direct execution of commands pasted from the clipboard (ClickFix) is a behavioral stage requiring deep script-block analysis, whereas this hunt focuses on the AI-mediated redirection chain.", "relation": "out-of-scope-alternative" } ], "targets": { "web": { "name": "Web server / proxy logs", "category": "siem", "telemetry": [ "network" ] }, "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A simple block on AI platforms is impractical for most organizations. This hunt uses prevalence analysis to identify rare AI artifact paths and correlates them with behavioral signals (browser-spawned shells) and known redirectors\u2014context a single static rule cannot weigh accurately without high false positives.", "coverage": [ { "stage": "initial-access-seo-redirection", "steps": [ "ai-platform-lead", "rare-shared-ai-paths" ], "status": "covered" }, { "stage": "malicious-payload-delivery", "steps": [ "malicious-redirect-connections", "browser-spawned-shells" ], "status": "covered" }, { "stage": "clipboard-command-execution", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" }, { "stage": "stealer-persistence", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" }, { "stage": "sensitive-data-access", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "AI Platform SEO Redirection", "slug": "initial-access-seo-redirection", "tactic": "initial-access", "techniques": [ "T1566.002", "T1204.001" ], "observables": [ "claude.ai", "chatgpt.com", "grok.com", "claude.ai/share", "sponsored search results", "Bing", "Google Search" ] }, { "name": "AI-Themed Payload Delivery", "slug": "malicious-payload-delivery", "tactic": "execution", "techniques": [ "T1204.001" ], "observables": [ "downloading-api.it.com", "ClaudeDesktop.exe" ] }, { "name": "Terminal and PowerShell Execution", "slug": "clipboard-command-execution", "tactic": "execution", "techniques": [ "T1059.001", "T1059.004" ], "observables": [ "curl", "powershell", "zsh", "bash", "Terminal", "Apple Support install guide lure", "Clear disk space lure" ] }, { "name": "Malware Persistence", "slug": "stealer-persistence", "tactic": "persistence", "techniques": [ "T1053.005" ], "observables": [ "new scheduled tasks", "SectopRAT", "AMOS", "MacSync" ] }, { "name": "Credential and Secret Theft", "slug": "sensitive-data-access", "tactic": "credential-access", "techniques": [ "T1555", "T1539", "T1552" ], "observables": [ "~/.ssh", "~/.aws", "~/Library/Keychains", "browser cookies", "Telegram sessions" ] } ], "summary": "Threat actors are utilizing SEO poisoning to lure victims into interacting with malicious artifacts and shared conversations on trusted AI platforms like Claude, ChatGPT, and Grok. These interactions lead to either the download of fake installers from malicious redirect domains or the execution of commands via Terminal and PowerShell that deploy credential stealers. The resulting malware, such as AMOS and MacSync, establishes persistence via scheduled tasks and exfiltrates sensitive credentials, cloud keys, and browser data." }, "severity": "high", "rationale": "The hunt begins with broad DNS visibility for AI platforms, narrowing only once rare shared paths or secondary redirection domains are identified. High-value workstations or users likely to use AI for development/support should be prioritized.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder is abusing trusted AI platforms such as Claude or ChatGPT to host malicious redirection lures via SEO poisoning, funnelling users from legitimate AI domains to secondary malware delivery infrastructure.", "parameters": { "ai_domains": { "from": { "ref": "https://www.huntress.com/blog/ai-attack-surface", "kind": "article", "observed": "2026-08-27" }, "type": "list[domain]", "default": [ "claude.ai", "chatgpt.com", "grok.com", "www.claude.ai", "www.chatgpt.com" ], "description": "Trusted AI domains used in redirection lures." }, "scope_hosts": { "from": { "ref": "analyst-scoping", "kind": "manual", "observed": "2024-05-20" }, "type": "list[host]", "default": [], "description": "Specific hosts to target; leave empty to hunt across the entire estate." }, "lookback_days": { "from": { "ref": "standard-policy", "kind": "manual", "observed": "2024-05-20" }, "type": "number", "default": "14", "description": "Days of history to examine." }, "shell_indicators": { "from": { "ref": "hunt-designer", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [ "powershell.exe", "pwsh.exe", "cmd.exe", "bash", "zsh", "sh", "terminal" ], "description": "Shell and interpreter process names to monitor for browser-spawned execution." }, "malicious_domains": { "from": { "ref": "https://www.huntress.com/blog/ai-attack-surface", "kind": "article", "observed": "2026-08-27" }, "type": "list[domain]", "default": [ "downloading-api.it.com" ], "description": "Known malicious redirect and payload delivery domains named in the research." }, "browser_indicators": { "from": { "ref": "hunt-designer", "kind": "manual", "observed": "2024-05-20" }, "type": "list[string]", "default": [ "chrome.exe", "msedge.exe", "firefox.exe", "safari", "brave.exe", "google chrome", "microsoft edge" ], "description": "Browser process names acting as parents for ClickFix-style execution." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://www.huntress.com/blog/ai-attack-surface", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://www.huntress.com/blog/ai-attack-surface", "name": "Huntress \u2014 The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms" } ], "blind_spots": [ { "id": "no-tls-decryption", "risk": "Without TLS decryption, only the root AI domain (e.g., claude.ai) is visible, making it difficult to distinguish a malicious artifact lure from standard platform usage.", "stage": "initial-access-seo-redirection", "question": "whether the specific /artifacts/ or /share/ path components are visible", "requires": "hb_http_activity with URI inspection (via decryption)" }, { "id": "rotating-delivery-infrastructure", "risk": "Attackers rotate delivery domains frequently; a negative result for 'downloading-api.it.com' does not prove absence of newer redirection variants.", "stage": "malicious-payload-delivery", "question": "whether the redirector domain has changed since publication", "requires": "continuously updated malicious_domains parameter" } ] }, "name": "AI Platform Mediated Malvertising and Redirection", "description": "This hunt identifies hosts that interact with shared AI platform content\u2014specifically Claude Artifacts and shared conversations\u2014and subsequently connect to known malicious redirect domains or exhibit suspicious browser-to-shell transitions. Attackers exploit the high domain reputation of AI platforms to bypass filters and establish trust before delivering payload-carrying commands or binaries. We focus on the rare transition from a trusted AI domain to a malicious delivery domain, a pattern that identifies initial access attempts mediated by these platforms." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "the-ai-attack-surface-how-threat-actors-abuse-trusted-ai-platforms", "index": 1, "title": "The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms", "total": 2 }, "coverage": [ { "stage": "initial-access-seo-redirection", "steps": [ "ai-platform-lead", "rare-shared-ai-paths" ], "status": "covered" }, { "stage": "malicious-payload-delivery", "steps": [ "malicious-redirect-connections", "browser-spawned-shells" ], "status": "covered" }, { "stage": "clipboard-command-execution", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" }, { "stage": "stealer-persistence", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" }, { "stage": "sensitive-data-access", "reason": "Belongs to another part of the 'The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms' series.", "status": "out_of_scope" } ], "rationale": "An intruder is abusing trusted AI platforms such as Claude or ChatGPT to host malicious redirection lures via SEO poisoning, funnelling users from legitimate AI domains to secondary malware delivery infrastructure.", "blind_spots": [ { "id": "no-tls-decryption", "risk": "Without TLS decryption, only the root AI domain (e.g., claude.ai) is visible, making it difficult to distinguish a malicious artifact lure from standard platform usage.", "stage": "initial-access-seo-redirection", "question": "whether the specific /artifacts/ or /share/ path components are visible", "requires": "hb_http_activity with URI inspection (via decryption)" }, { "id": "rotating-delivery-infrastructure", "risk": "Attackers rotate delivery domains frequently; a negative result for 'downloading-api.it.com' does not prove absence of newer redirection variants.", "stage": "malicious-payload-delivery", "question": "whether the redirector domain has changed since publication", "requires": "continuously updated malicious_domains parameter" } ], "scoping_notes": "The hunt begins with broad DNS visibility for AI platforms, narrowing only once rare shared paths or secondary redirection domains are identified. High-value workstations or users likely to use AI for development/support should be prioritized.", "beyond_detection": "A simple block on AI platforms is impractical for most organizations. This hunt uses prevalence analysis to identify rare AI artifact paths and correlates them with behavioral signals (browser-spawned shells) and known redirectors\u2014context a single static rule cannot weigh accurately without high false positives." } }, { "id": "ai-platform-lead", "type": "query", "label": "Identify AI platform resolution", "config": { "dsl": "sqlite", "role": "scoping", "source": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_dns_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.claude.ai' OR LOWER(query_hostname) LIKE '%.chatgpt.com') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC", "surface": "hb_dns_activity", "description": "Identify hosts that have interacted with targeted AI platforms to establish the initial candidate set for the redirection hunt.", "expected_signal": "A list of hosts and the specific AI domains they resolved. Silence indicates no traffic to these platforms, proving absence of the reported redirection chain." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Identify AI platform resolution", "reads": [ "device_hostname", "query_hostname", "time" ], "source": "hb_dns_activity", "target": "endpoint", "content": "SELECT device_hostname, query_hostname, COUNT(*) AS lookup_count, MIN(time) AS first_seen, MAX(time) AS last_seen FROM hb_dns_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.claude.ai' OR LOWER(query_hostname) LIKE '%.chatgpt.com') AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname ORDER BY lookup_count DESC", "silence": "evidence_of_absence", "expected": "A list of hosts and the specific AI domains they resolved. Silence indicates no traffic to these platforms, proving absence of the reported redirection chain.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "rare-shared-ai-paths", "type": "query", "label": "Rare shared AI platform paths", "config": { "dsl": "sqlite", "role": "baseline", "source": "web", "content": "SELECT url_hostname, url_path, COUNT(DISTINCT device_hostname) AS host_count, GROUP_CONCAT(DISTINCT device_hostname) AS hosts FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(url_path) LIKE '%/share/%' OR LOWER(url_path) LIKE '%/artifacts/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_hostname, url_path HAVING host_count <= 3 ORDER BY host_count ASC", "surface": "hb_http_activity", "description": "Identify hosts visiting specific shared content that is rare across the fleet, suggesting a targeted lure rather than general platform usage.", "expected_signal": "A list of rare URLs visiting shared AI content. Rare paths are high-probability candidates for malicious artifacts." }, "parents": [ { "id": "ai-platform-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare shared AI platform paths", "reads": [ "url_hostname", "url_path", "device_hostname", "time" ], "source": "hb_http_activity", "target": "web", "content": "SELECT url_hostname, url_path, COUNT(DISTINCT device_hostname) AS host_count, GROUP_CONCAT(DISTINCT device_hostname) AS hosts FROM hb_http_activity WHERE (instr(',' || '{{ai_domains}}' || ',', ',' || LOWER(url_hostname) || ',') > 0) AND (LOWER(url_path) LIKE '%/share/%' OR LOWER(url_path) LIKE '%/artifacts/%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY url_hostname, url_path HAVING host_count <= 3 ORDER BY host_count ASC", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A list of rare URLs visiting shared AI content. Rare paths are high-probability candidates for malicious artifacts.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "url_hostname", "url_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "malicious-redirect-connections", "type": "query", "label": "Check for malicious redirect traffic", "config": { "dsl": "sqlite", "role": "enrichment", "source": "network", "content": "SELECT device_hostname, dst_endpoint_hostname, dst_endpoint_ip, process_name, time FROM hb_network_connection WHERE instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "surface": "hb_network_connection", "description": "Detect network connections to infrastructure identified as the secondary delivery stage following an AI platform redirection.", "expected_signal": "Any connection to the specified redirect domains. Hits indicate the user progressed past the initial lure to the payload site." }, "parents": [ { "id": "ai-platform-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "enrichment", "label": "Check for malicious redirect traffic", "reads": [ "device_hostname", "dst_endpoint_hostname", "process_name", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, dst_endpoint_hostname, dst_endpoint_ip, process_name, time FROM hb_network_connection WHERE instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(dst_endpoint_hostname) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC", "silence": "not_evidence_of_absence", "expected": "Any connection to the specified redirect domains. Hits indicate the user progressed past the initial lure to the payload site.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "browser-spawned-shells", "type": "query", "label": "Browser-spawned terminal processes", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{shell_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{shell_indicators}}' || ',', ',' || LOWER(process_path) || ',') > 0) AND (instr(',' || '{{browser_indicators}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_process_activity", "description": "Detect behavioral signals of 'ClickFix' where a browser redirects a user to instructions that result in terminal execution.", "expected_signal": "Shell launches where the parent is a web browser. This behavior is highly suspicious when it occurs immediately following an AI platform visit." }, "parents": [ { "id": "ai-platform-lead" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Browser-spawned terminal processes", "reads": [ "device_hostname", "process_name", "parent_process_name", "process_cmd_line", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, parent_process_name, process_cmd_line, time FROM hb_process_activity WHERE (instr(',' || '{{shell_indicators}}' || ',', ',' || LOWER(process_name) || ',') > 0 OR instr(',' || '{{shell_indicators}}' || ',', ',' || LOWER(process_path) || ',') > 0) AND (instr(',' || '{{browser_indicators}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Shell launches where the parent is a web browser. This behavior is highly suspicious when it occurs immediately following an AI platform visit.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "triage-redirection", "type": "analytic", "label": "Correlate redirection and behavior", "config": { "cite": "required", "tools": [ "endpoint", "network", "web" ], "context": [ "ai-platform-lead", "rare-shared-ai-paths", "malicious-redirect-connections", "browser-spawned-shells" ], "objective": "Determine if a host followed the AI redirection sequence: accessed a trusted AI platform, visited a rare shared link or artifact, and then connected to a malicious domain or spawned a shell. Cite specific timestamps to demonstrate a temporal link between the lure and the behavioral signal.", "description": "Evaluate whether the combination of AI platform interaction, rare path access, and suspicious connection or shell behavior indicates a successful lure.", "max_iterations": 6, "success_criteria": "A per-host verdict of malicious, suspicious, or benign citing correlated rows." }, "parents": [ { "id": "rare-shared-ai-paths", "kind": "merge" }, { "id": "malicious-redirect-connections", "kind": "merge" }, { "id": "browser-spawned-shells", "kind": "merge" } ] }, { "id": "route-on-verdict", "type": "checkpoint", "label": "Route based on agent verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage verdict is malicious for at least one host, indicating a confirmed transition from a rare AI artifact to malicious infrastructure or browser-spawned shells", "condition": "the triage verdict is malicious for at least one host, indicating a confirmed transition from a rare AI artifact to malicious infrastructure or browser-spawned shells", "blind_spot": "no-tls-decryption", "confidence": "high", "description": "Automate the response path based on the confidence of the redirection triage.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-redirection" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate affected host", "config": { "target": "endpoint", "description": "Contain the threat after a confirmed redirection and malware delivery event.", "instructions": "Isolate the host immediately. Retrieve any associated binaries identified in the browser-spawned shell command lines for further analysis.", "action_approval": "required" }, "parents": [ { "id": "route-on-verdict", "branch": "on_supports" } ] }, { "id": "analyst-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Review the host context to identify the specific AI lure and verify manual command execution.", "instructions": "Verify the AI platform shared paths and check hb_script_activity for commands matching ClickFix lures. Confirm whether the redirection resulted in a successful malware infection (e.g., SectopRAT or AMOS)." }, "parents": [ { "id": "route-on-verdict", "branch": "default" }, { "id": "route-on-verdict", "branch": "on_unavailable" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Hunt closure", "config": { "assignee": "analyst", "description": "Document the findings and recommend permanent detection tuning.", "instructions": "Record the results of the triage and any identified malicious indicators. If browser-spawned shell behavior is verified as high-confidence, promote it to a standing detection rule." }, "parents": [ { "id": "route-on-verdict", "branch": "on_refutes" }, { "id": "analyst-review" } ] } ] }