Fake Claude installer promoted by Bing ads hits 29 organisations with SectopRAT
Attackers hid a phishing page on Anthropic's own domain, then bought Bing ads to send people to a booby-trapped 'Claude Desktop' download.
Key points
- A malvertising campaign on Bing pushed a fake Claude desktop app on 21 and 22 July, breaking into at least 29 organisations.
- The phishing page sat on Anthropic's own claude.ai domain as a Claude Artifact, viewed 7,100 times before removal.
- The fake ClaudeDesktop.exe installer delivered SectopRAT, a remote access trojan that steals passwords, card data, browser cookies and session tokens.
- Huntress researchers named the operation FakeAgent and could not tie it to any known criminal group.
- The malware fetches its control server address by reading transactions on the BNB Smart Chain, a technique called EtherHiding.
Anthropic's chatbot Claude has a fake desktop app problem. Criminals bought sponsored results on Microsoft's Bing search engine, pointing people who searched for Claude towards a download page that looked entirely legitimate. It sat on claude.ai itself.
The trick worked. Researchers at security firm Huntress, who spotted the operation and named it FakeAgent, say at least 29 organisations were compromised on 21 and 22 July. The original reporting on the malvertising side came via BleepingComputer.
How did a phishing page end up on Claude's own website?
Attackers abused a Claude feature called Artifacts, which lets any user publish interactive content on a claude.ai subdomain. To a browser, and to a wary user checking the address bar, the page really was hosted by Anthropic.
That gave the lure enormous credibility. The malicious Artifact was viewed 7,100 times before Anthropic pulled it down, directing visitors to separate sites serving the actual installer, a file called ClaudeDesktop.exe. The same Artifacts trick appeared earlier this year in a campaign pushing macOS malware through ClickFix lures, where victims are talked into pasting a command into their own machine. We covered the ClickFix method in detail on 20 July, when Microsoft flagged two credential-stealing campaigns using the same social-engineering approach.
What does the malware actually do?
It steals almost everything a criminal can sell. The payload is SectopRAT, also tracked as ArechClient2, a remote access trojan (a program that gives an attacker hands-on control of your PC from anywhere) that has been circulating since 2019.
SectopRAT grabs saved passwords, credit card details, FTP credentials and browser cookies, along with data from Discord, Telegram, Steam and various VPN clients. It also includes HVNC, or Hidden Virtual Network Computing, which lets an operator quietly drive a second, invisible desktop session on the victim's machine while they carry on working.
ClaudeDesktop.exe is not itself malware. It's a genuine signed component from JetBrains that loads a poisoned support file (libcef.dll) sitting next to it, a technique called DLL sideloading. Persistence is handled by a second file, DockerDesktop.exe, which creates a scheduled task so the infection survives reboots.
| Detail | Value |
|---|---|
| Campaign name | FakeAgent |
| Active window | 21 to 22 July |
| Organisations breached | At least 29 |
| Artifact views before takedown | 7,100 |
| Final payload | SectopRAT (ArechClient2) |
| Delivery | Bing sponsored ads to a Claude Artifact |
How does it hide from security tools?
Aggressively. Loaders are wrapped in VMProtect, a commercial packer that makes reverse engineering painful. They also check GPU and VRAM values and look for signs of a virtual machine, so the malware refuses to run inside an analyst's sandbox.
Once active, SectopRAT finds its command server through EtherHiding: it reads a transaction on the BNB Smart Chain, a public cryptocurrency network, and pulls the current server address from that. Blocking the server is hard when the address list lives on a blockchain no one controls.
Huntress used Claude Opus 4.8 itself to help pick apart the shader checks and the encrypted .NET payload. That analysis pointed at 10 domains registered to a single email address since December, one of which had already been seized in the international Operation Endgame takedown linked to the StealC info-stealer.
Should you worry if you searched for Claude recently?
Yes, if you downloaded anything from a sponsored result. Multi-factor authentication wouldn't have helped here, since this is a straight malware install rather than a credential-phishing run. Rotating any passwords entered on an affected machine and revoking browser session cookies would. Download software from the vendor's official site, typed directly into the address bar, not from sponsored search results.
