Threat Actors Abuse Claude Artifacts and AI Platforms to Distribute Malware

Threat actors are increasingly targeting users of trusted AI platforms, researchers from Huntress report. Campaigns have been observed abusing Claude Artifacts to host malicious content, manipulating search results to promote weaponized AI-generated files, and using ClickFix-style lures shared through AI conversations to trick users into executing malware. In these campaigns, attackers upload seemingly legitimate code or project files to AI platforms; however, these artifacts contain obfuscated scripts or links that, when interacted with by a user, can lead to the download and execution of malware on the victim's system. Additionally, sponsored search results and shared AI conversation links are being used to direct users to these weaponized artifacts. The abuse of trusted platform features allows the malicious content to bypass some security filters that would normally flag executable files or known malicious domains. Huntress notes that no specific vendor patch has been released, as the abuse leverages the platforms' designed functionality, though platform operators are reportedly investigating the campaigns. The report underscores the evolving attack surface presented by the integration of AI tools into daily workflows and the need for heightened user awareness when interacting with AI-generated content and search results.