Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign 
Indicators of Compromise (IOCs) 

Google Ads Campaign IDs 

23736589328 
23785277018 
23740351161 
23793410627 
23775361599 
23822005592 
23816419356 
23828204858
23874662556
23877282159
23878517006
23882865816
23884066026
23884287567
23885179352
23889178448
23889189104
23892302800
23893995754
23894054602
23895065468
23895258210
23897571310
23900325598
23912501719

---

Notable Malicious Hostnames` (GitLab Pages) 

claude-code-app.gitlab.io 
claude-desktop-lm.gitlab.io 
cladesktop.gitlab.io 
claudecode-desktop.gitlab.io 
claude-app-new.gitlab.io 
claude-desktop.gitlab.io 
claudeapp.gitlab.io 
claudesktop.gitlab.io 
claudesktop-app.gitlab.io 
perplexity-platform.gitlab.io 
codexgpt.gitlab.io 
chatgpt-codex-app.gitlab.io 
chatgpt-codex-lm.gitlab.io 
cursor-8ced8a.gitlab.io 
jetbrains-apps-group.gitlab.io 

---

Loader/C2 Domains (Claude.ai Abused Share IDs) 
bernasibutuwqu2.com 
briskinternet.com 
isgilan.com 
a2abotnet.com 
customroofingcontractors.com 
claude-code.official-version.com 
jerryshvac.com 
oaklandwaterdamage.com 
thnikagent.com 
babulikinet.com 
loserrq0j1sha8.com 
peowqlauoshau8.com 
plirepsijr74.com 
homeinspectionnaperville[.]com
yoauction[.]com
alabamarecoverycenter[.]com
5x5web[.]com
touristprogram[.]com
bewqslkslikrtjinfg9[.]com

---

Claude.ai Abused Share IDs (Top 5 by Traffic) 

claude.ai/share/498818d9-1ddc-4fbb-9fa7-56dfb84840b0 
claude.ai/share/cfc70dcd-779c-4f4a-966c-ec12b7ea166f 
claude.ai/share/b2699c2e-1260-4a3f-b312-e5288a43fd11 
claude.ai/share/41b11dc2-ac83-4cb4-8f38-ac63b75e9e62 
claude.ai/share/b81a4375-1d0d-43cc-ad89-6a1007b4e7e5 

---

UUIDS
03ec595f-6684-49a1-bfec-52bd40f419b6
058320ad-20f2-4ce4-92d7-2752e3f02011
1fc0aa18-d0e6-431e-aaec-04ab92b0e3be
2d0da4e5-a741-41ca-8961-5fd7a7856069
38ce4ab6-30bd-4616-9ff0-3ac8c2c05380
39c0bc32-38a5-4d6c-a9db-d2652d49e5c6
3a904a49-11c3-4231-94ba-5ec951a5d5bb
40960d28-cb99-46d0-a252-34ca600f3878
54c10881-ede9-4fbb-89b2-2e84b20cad8b
5a851a8e-ab87-4065-8e46-522022df6fc0
6178c799-8718-403d-93fe-82563ca9bcee
8e6401b5-4849-46c4-a3cb-29e1c3c49131
92e8a3d2-2123-4f2b-9b9e-79c86e717ddd
92fd6c46-9c0a-418a-8439-5daf7506f88e
95d830b5-dbbc-4591-b306-3a93492432f7
99f1cfb1-7137-40bb-9e15-a9ddce560c48
ad33791b-d8e3-4ad3-9098-b1873d089047
b0ef1ce2-09f5-460b-bf94-69d66b67e13d
b27f0e41-5a4d-4d29-bad3-52a467c692cf
b57cb157-718c-467a-bf9f-89c246cf1169
cadb59ff-abfe-4c48-aa9a-07c612b176d6
d3a719f0-5fba-4279-bbdc-7eac14fc45e1
e54acff3-5ca0-468c-9f86-b79a824988b1
e8aabf66-156b-4894-a016-ca37098873ff
ec6a57d3-6ff0-4a6b-bf02-d1498b7ec9b9
ef10517b-b689-4033-b40d-b357ffa169c9
053b594d-0fb0-4e8c-9b29-a462d5f5a758
05bc7627-1112-4147-bd3f-4fef8b0816c4
08b27f57-87b6-4ec9-b7c2-ead1c7a8c409
1206a4cb-702a-49db-a0b8-f243c6dd8113
12900f0c-7b05-47fd-9661-90fec35dcea1
146061d5-086a-40a8-a5a1-db9d99ab7248
163a0a2a-0e18-4d6e-99f0-ff4a4bdfc46d
16650b04-ab18-416f-8259-9a3e58278dad
20b5e745-2509-4252-adfe-5dcac4d0353a
27a1d1bf-668a-4080-930d-99f6af824ec3
2e1d6a0f-2f45-47b7-9903-92dae374e008
39334b4c-af2a-4378-9915-7bca0b2db563
3bd5944d-a379-476a-abb0-b64f19ba457e
4ff211a6-d527-42d0-99d6-d3eacb54d080
5c524d87-e306-4d37-b97c-2c80b074d198
5f1dd234-2e99-4134-ab11-90da76fe5a46
6e964833-e261-4e6c-b51d-3a11f8a4b61d
71cf3ed4-7e91-47df-a283-0d06e6e606ed
77eb9d31-4253-4c50-9960-e0fcffd81cca
7eb80012-23b6-4e4e-9c92-175c360acd5f
889e1a43-84df-4116-b2c9-8d46717980c5
8c3dee26-de52-4de3-bda5-f7c2d8068115
8cdb3f27-85dc-4dc5-8b78-a430d779798b
9ca7c772-bffa-44fd-b795-c7d4eba4cff8
9de1ce50-0baa-4e03-917b-638573aaa383
ad29b8ba-62bf-467a-94d1-0ddaa79ad28f
b76ac00b-2a54-44ca-9baa-1a261405744d
b8820056-d084-40c1-8e1d-03624bcfd04e
bd2fc641-329e-45d2-8c0e-b62927ad3eed
c0957867-5afd-4489-9813-a4fb48a06494
c97728cd-f881-4dda-90d5-70648eabd0e0
d11fe865-54b2-47ee-9761-59b2bf7bf0cb

**