Security researchers have uncovered a malvertising campaign that targeted anyone searching for Anthropic’s Claude desktop application on Bing. Between July 21 and July 22, at least 29 organizations were compromised after clicking a sponsored ad that appeared to lead directly to the official claude.ai domain.
Exploiting a trusted domain and public artifacts
The attackers did not breach Anthropic’s infrastructure. Instead, they exploited Claude’s Artifacts feature, which allows users to generate and publicly share code, documents, or entire web pages in a panel alongside the chat. Because Artifacts are served under the claude.ai domain and can be opened without an account, the campaign’s operators built a convincing replica of the official download page and directed a paid Bing advertisement to it.
For most visitors, the trap was nearly invisible. The address bar displayed claude.ai, and the only on‑page signal was a small notice in the top left corner reading “Content is user-generated and unverified.” The malicious page accumulated roughly 7,100 views before Anthropic removed it following a report from the security firm Huntress, which has named the operation FakeAgent.
A sideloading chain delivers a persistent trojan
Clicking the download button did eventually redirect away from the legitimate domain, first to claude.ai.download-app[.]us and then to downloading-api.it[.]com. Here, the familiar “claude.ai” string served merely as a subdomain of the actual domain download-app.us, which was registered on May 9.
The file delivered to victims—ClaudeDesktop.exe—is not Anthropic software at all. It is a valid, digitally signed component from JetBrains that is susceptible to DLL sideloading. In this technique, a tampered Dynamic Link Library is placed alongside a clean executable. The program loads the library without verification, and the malicious code executes under the cover of a trusted signature.
At the end of the infection chain sits SectopRAT, a remote access trojan active since 2019. It harvests passwords, credit card details, browser logins and cookies, files, FTP credentials, data from Discord and Telegram, and accounts linked to Steam and VPN services. To maintain persistence, the campaign also drops a file named DockerDesktop.exe and registers it as a scheduled task, ensuring the machine is repeatedly reinfected.
Huntress notes that the malware actively resists analysis. It is packed and checks the graphics card and video memory to detect virtual machines, the isolated environments security researchers rely on. The firm used Claude Opus 4.8—the predecessor to the recently released Claude Opus 5—for its own investigation.
A recurring pattern and practical defenses
The July incident is not isolated. In May, a fake Claude website was already distributing a Windows backdoor via Google ads. And according to Huntress, in April the same threat actor leveraged Docker Hub to spread a bogus Docker Desktop installer built on the same tampered library, which explains the leftover DockerDesktop.exe file found in the current bundle.
The campaign highlights how little the address bar can guarantee when platforms serve user‑generated content under their own root domains—a practice common to claude.ai, Google Docs, and GitHub alike. As a rule, software should not reach a user’s machine through a search advertisement. Anthropic distributes official Claude applications at claude.com/download, and any other program should be obtained by typing the maker’s address directly or using a trusted bookmark. If a download does bypass caution, a second layer of defense becomes critical: infostealers such as SectopRAT immediately target browser‑stored credentials, and hardening accounts so that a stolen password alone is insufficient remains essential.
Sources: www.huntress.com, www.bleepingcomputer.com