The Intake
The Intake — Sunday, July 26, 2026
On the substrate
Malvertising campaign turns Claude Artifacts into malware relay, hitting 29 organizations via Bing
If you've been treating the claude.ai domain as a trust signal for artifacts others share with you, the Huntress FakeAgent report names what the malvertising campaign exploited.
A Bing search ad campaign ran July 21–22. It presented as an official Claude download prompt. Clicking the ad led to a Claude Artifact hosted on the legitimate claude.ai domain. The Artifact redirected visitors to external sites hosting ClaudeDesktop.exe — an installer disguised as the Claude desktop application. The installer used DLL sideloading. It loaded a malicious library alongside a JetBrains Chromium component. The payload was SectopRAT, also documented as ArechClient2. SectopRAT is an information stealer. It can open an HVNC session on the victim's machine — a hidden remote desktop running invisibly to the user. It resolves command-and-control addresses via the Ethereum blockchain through a technique called EtherHiding. That makes the infrastructure harder to block at the network level. The Artifact was downloaded 7,100 times before removal. Huntress confirmed 29 organizations compromised over July 21–22.
If you share Claude Artifact URLs as part of your workflow — or receive them from colleagues — the domain alone is not sufficient to establish trust. The malicious Artifact used Anthropic's legitimate domain; the redirect to the installer was the attack path.
---
AMD announces Helios rackscale AI system and EPYC 9006 series for agentic workloads
AMD press release SiliconANGLE SiliconANGLE
Helios is AMD's new rackscale AI system. AMD announced it July 23 at the Advancing AI 2026 event. Each rack combines 72 Instinct MI455X GPUs and 18 sixth-generation EPYC processors. AMD says the system delivers 2.9 exaflops of peak FP4 compute per rack. Each rack also carries 31 terabytes of HBM4.
The EPYC 9006 series ships four variants. The SP7 runs 256 cores and 512 threads. AMD positions it for agent sandbox execution. The SP8 targets power-constrained deployments in 8–128 core configurations. The SP7X clocks to 5.15 GHz peak with three times the L3 cache per core. AMD aims it at HPC workloads. The LP "Verano" variant is a low-power AI host node. The Instinct MI400 GPU series includes the MI455X, the MI430X, and the MI350P. AMD says the MI430X delivers 288 TFLOPS FP64. The GPU-to-GPU interconnects are encrypted. AMD named Anthropic, OpenAI, Meta, and Cerebras as deployment partners. Samples ship "later in the year," per AMD, without a specific date.
No near-term practitioner implication — hardware ships on an unspecified timeline; this is a roadmap announcement.
---
For operators
Open-source Hermes AI agent run without human approval prompts in attack on Thailand's Finance Ministry; Hades backdoor staged
If your agent deployments include a "YOLO mode" or equivalent configuration that removes human approval gates, the Thailand Finance Ministry incident names the post-exploitation profile that combination enables once an attacker holds valid credentials.
Hunt.io and security researcher Bob Diachenko disclosed July 23 their analysis of attacker staging directories. Those directories were exposed July 9–13. A threat actor deployed Hermes — an open-source AI agent — to automate post-exploitation. Hermes has a configuration called "YOLO mode" that removes all human approval prompts. With approval gates disabled, the agent executes commands autonomously without any human confirmation step. The threat actor obtained valid session tokens for the Finance Ministry admin panel. With those credentials and Hermes in YOLO mode, the attacker deployed a PHP web shell. The attacker also ran network enumeration. The enumeration targeted Hadoop, Apache Ambari, and GlassFish services. The attacker also staged a custom Go-based backdoor named Hades. It shipped in both Windows and Linux variants. Hades uses AES-256-GCM HTTPS beaconing. It includes built-in kill dates and operational scheduling. The threat actor catalogued personnel records dating to 2012. Hunt.io found no evidence of exfiltration. Attribution indicators include VShell/ShadowPad infrastructure history and Simplified Chinese tooling documentation. Hunt.io also flagged Hong Kong-based ASNs. Thailand's Finance Ministry has not confirmed the breach.
If you're running agent configurations where approval gates have been removed in production, the relevant check is whether those configurations are reachable by anyone who obtains valid credentials — this incident documents the automation profile that follows from that combination.
---