Fake Claude Desktop Ads Hit 29 Organisations With Data-Stealing Malware

Cybersecurity firm Huntress has uncovered a malvertising campaign that used a fraudulent listing hosted directly on Anthropic’s Claude.ai domain to trick users into downloading a data-stealing trojan disguised as the Claude Desktop app.

According to a blog post published by Huntress, at least 29 organisations were affected between 21 and 22 July after employees searched for the Claude desktop app on Bing and clicked what looked like a legitimate sponsored link.

Rather than leading straight to a fake external site, the link pointed to a public “Artifact”, a shareable file or mini webpage that anyone can publish on Claude.ai. The malicious page redirected users to an attacker-controlled site where they downloaded a fake ClaudeDesktop.exe installer, which ultimately delivered the SectopRAT stealer. Huntress has dubbed the campaign “FakeAgent.”

Because the initial link sat on Anthropic’s own domain, it carried an unusual degree of trust, users had no obvious reason to suspect anything was wrong before the redirect to the attacker’s infrastructure kicked in. Huntress said the page had racked up 7,100 views before it was reported and taken down.

How The Claude.ai Malware Worked

Once installed, the fake app exploited DLL sideloading, smuggling a tampered malicious file alongside a legitimate, signed executable so the malicious code runs under the guise of a trusted programme. In this case, the attackers abused a genuine JetBrains component to load their payload.

The malware was wrapped in commercial protection software to resist reverse engineering and built in checks, including scanning a machine’s graphics hardware and running timing tests, designed to detect whether it was running inside a virtual machine or analysis sandbox, in which case it would refuse to execute.

Command-and-control instructions were hidden inside blockchain transactions on the Ethereum network, a technique known as “EtherHiding” that makes it far easier for attackers to relocate their infrastructure without losing control of infected machines.

Once decrypted, researchers found the payload matched, or was closely derived from, SectopRAT, a remote access trojan capable of harvesting saved passwords, browser cookies, autofill data, credit card details and files from an infected computer.

Huntress said its own analysts used Claude to help work through some of the more complex reverse-engineering steps during the investigation, including rebuilding parts of the encryption scheme used to protect the malware’s payload.

Investigators also linked the campaign’s registration details to a threat actor behind a similar fake Docker Desktop scam earlier this year, and to infrastructure previously seized as part of Microsoft’s Operation Endgame, an international operation targeting malware distribution networks.

Anthropic Response

Huntress reported the malicious artifact to Anthropic, and the page had been removed by the time the report was published.

The Bigger Picture

The incident highlights a growing trend: as AI tools surge in popularity, their official domains and platforms are becoming attractive targets for malvertising and content abuse, since a link on a trusted domain can bypass the instinctive caution users apply to unfamiliar sites.

Huntress urged users to be cautious with sponsored search results, even ones that appear to point to legitimate domains, and to verify software downloads through official channels rather than search ads.