Fake Claude installer promoted by Bing ads hits 29 organisations with SectopRAT
Attackers hid a phishing page on Anthropic's own domain, then bought Bing ads to send people to a booby-trapped 'Claude Desktop' download.
Key points
- A malvertising campaign on Bing pushed a fake Claude desktop app between 21 and 22 July, breaking into at least 29 organisations.
- The phishing page sat on Anthropic's own claude.ai domain as a Claude Artifact, and was viewed 7,100 times before removal.
- The fake ClaudeDesktop.exe installer delivered SectopRAT, a remote access trojan that steals passwords, card data, browser cookies and messaging app logins.
- Huntress researchers named the operation FakeAgent and could not tie it to any known criminal group.
- The malware fetches its control server address by reading transactions on the BNB Smart Chain, a technique called EtherHiding.
Anthropic's chatbot Claude has a fake desktop app problem. Criminals bought sponsored results on Microsoft's Bing search engine, pointing people who searched for Claude towards a download page that looked entirely legitimate. It sat on claude.ai itself.
The trick worked. Researchers at security firm Huntress, who first spotted the operation and named it FakeAgent, say at least 29 organisations were broken into over a 48-hour window on 21 and 22 July. The original reporting on the malvertising side came via BleepingComputer.
How did a phishing page end up on Claude's own website?
The attackers abused a Claude feature called Artifacts, which lets any user publish interactive content on a claude.ai subdomain. To a browser, and to a wary user checking the address bar, the page really was hosted by Anthropic.
That gave the lure enormous credibility. The malicious Artifact was viewed 7,100 times before Anthropic pulled it down. It nudged visitors off to separate sites that served the actual installer, a file called ClaudeDesktop.exe.
The same tactic surfaced earlier this year in a campaign that pushed Mac malware through so-called ClickFix lures, where victims are talked into pasting a command into their own machine.
What does the malware actually do?
It steals almost everything a criminal can sell. The payload is SectopRAT, also tracked as ArechClient2, a remote access trojan (a program that gives an attacker hands-on control of your PC from anywhere) that has been circulating since 2019.
SectopRAT grabs saved passwords, credit card details, files, browser logins and cookies, FTP credentials, and data from Discord, Telegram, Steam and various VPN clients. It also includes HVNC, or Hidden Virtual Network Computing, which lets an operator quietly drive a second, invisible desktop session on the victim's machine while they carry on working.
The fake ClaudeDesktop.exe is not, in fact, malware itself. It is a genuine signed component from JetBrains that loads a poisoned support file (libcef.dll) sitting next to it, a technique called DLL sideloading. Persistence is handled by a second file, DockerDesktop.exe, which creates a scheduled task so the infection survives reboots.
| Detail | Value |
|---|---|
| Campaign name | FakeAgent |
| Active window | 21 to 22 July |
| Organisations breached | At least 29 |
| Artifact views before takedown | 7,100 |
| Final payload | SectopRAT (ArechClient2) |
| Delivery | Bing sponsored ads to a Claude Artifact |
How does it hide from security tools?
Aggressively. The loaders are wrapped in VMProtect, a commercial packer that makes reverse engineering painful. They also run shader timing checks, look at GPU and VRAM values, and try to spot signs of a virtual machine, all so the malware refuses to run inside an analyst's sandbox.
Once active, SectopRAT finds its command server through EtherHiding, meaning it reads a transaction on the BNB Smart Chain, a public cryptocurrency network, and pulls the current address out of that. Blocking the server is hard when the address list lives on a blockchain no one controls.
Huntress used Claude Opus 4.8 itself to help pick apart the shader checks and the encrypted .NET payload. That analysis pointed at 10 domains registered to a single email since December, one of which had already been seized in the international Operation Endgame takedown linked to the StealC info-stealer.
What should ordinary users do?
Download software from the vendor's official site, typed directly into the address bar, not from sponsored search results. Would multi-factor authentication have helped here? Honestly, no, this is a straight malware install, not a credential-phishing run. But rotating any passwords entered on an affected machine, and revoking browser session cookies, absolutely would.
