The AI Attack Surface: How Threat Actors Abuse Trusted AI Platforms

The report documents multiple campaigns where attackers weaponized trusted AI platforms and shared conversation/artifact features (Claude, ChatGPT, Grok) and sponsored search listings to host lures and drive victims to malicious redirects or clipboard-driven commands; resulting infections included SectopRAT, AMOS and MacSync stealers that exfiltrated credentials, cookies, keychain items and other secrets. Defenders are advised to restrict clipboard/script execution, enforce application allow-listing, monitor persistence and AV exclusion changes, use ad blockers, and rapidly report malicious content to platform vendors.