Claude FakeAgent DLL Side-Loading of libcef.dll via JetBrains/Claude Binaries

Emiliano Mema@Nosalva

•updated Aug 31, 2026•1•0•2

Detects instances of DLL side-loading where common application helper binaries (ClaudeDesktop.exe or JetBrains) load libcef.dll from untrusted, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of the Claude FakeAgent campaign, which leverages side-loading for payload deployment.