THREAT REPORT - MALVERTISING

The fake Claude Desktop download was hosted on Anthropic's own domain

For two days in July 2026, a sponsored Bing result for the Claude Desktop app pointed at the genuine claude.ai domain. The page it opened was a Claude Artifact published by an attacker, and its Download button led to an installer carrying the SectopRAT infostealer. Huntress counted at least 29 compromised organizations.

SB

SafeBrowz Threat Research Security ResearchJuly 26, 202611 min read

The one sponsored result that was not a lookalike

Start where the victims started. Somebody types "Claude Desktop app" into Bing because they want the desktop version of a tool they already use. The sponsored block at the top of the results is, by the account Huntress published on July 22, 2026, full of fake Claude Desktop pages. That part is routine. We have written about that exact market before, in our breakdown of search ads selling fake ChatGPT and Sora installers and in the wider guide to malvertising.

What was not routine is what sat among them. Huntress describes it plainly: mixed in with the fake pages "was a sponsored link to the legitimate Claude.ai domain." A careful person, one who has been taught to ignore the ad copy and read the URL underneath it, would have looked at that line, seen the vendor's real domain, and clicked with more confidence than the people who clicked the obvious fakes.

They were right about the domain. They were wrong about what a domain proves.

Artifacts turned claude.ai into a hosting provider

Anthropic's Artifacts feature lets Claude produce a self-contained thing, a document, a diagram, a small working web app, in a panel next to the conversation. Since Anthropic added public sharing, a user can publish that artifact so anyone with the link can open it, and the published page lives at an address under the vendor's own domain in the shape claude.ai/public/artifacts/<id>. The one used in this campaign was claude.ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877. Anthropic documents the mechanism plainly in its help center article on publishing and sharing artifacts, which says publishing "makes your artifact publicly available" and that "anyone with the link can view and interact with it."

That is a genuinely useful feature and there is nothing wrong with it as designed. It is also, structurally, user-generated hosting on a first-party domain, which is the same property that makes Google Docs links, Notion pages and other user-content hosts such reliable phishing surfaces. The trust belongs to the platform. The content belongs to whoever showed up.

Anthropic does mark this. Artifact pages carry the line "Content is user-generated and unverified." Help Net Security, reporting the incident on July 23, 2026, pointed out how little that helps in practice: it is a short sentence in the upper left of the page, next to a full-width layout that reproduced a Claude Desktop download page convincingly enough that nobody stopped. A disclaimer competing with a working replica of an official product page is not a fair fight.

Huntress reported the artifact to Anthropic, and it had already been taken down by the time the research went out on July 22. By then the page had logged roughly 7,100 views. Worth being precise about that number, because it has been reported both ways: Huntress counted page views of the artifact link, not completed downloads. The 29 compromised organizations are the confirmed damage.

This is the second time in recent months we have covered malware served from a page on an AI vendor's real domain. The first was the LLMShare campaign on genuine chatgpt.com share links. Two vendors, two different sharing features, one identical lesson.

The two hops after you press Download

The artifact itself did not host the file. It was a doorway. Clicking Download sent the browser to claude.ai.download-app[.]us, and from there to downloading-api.it[.]com, on a path ending /html/claude/win, which served the file.

Look hard at that first hostname, because it is the single most instructive artifact of the whole campaign. It reads, left to right, as though it belongs to Claude. It does not. Hostnames are owned right to left. The part that determines ownership here is download-app[.]us, registered by whoever wanted it. Everything to the left of that, including the string "claude.ai", is a label the attacker typed. They chose it because it puts the vendor's real domain, dot and all, at the start of the address where the eye lands first. We walk through reading hostnames in that direction in our guide to checking whether a website is a scam.

The second hop is quieter and, from a defender's point of view, more awkward. downloading-api.it[.]com borrows no brand at all. It is a plausible-sounding infrastructure name sitting under an established registrable domain, and it appears for a fraction of a second in the middle of a redirect chain that ends in a save dialog. Nobody reads it. There is nothing in the name to read.

ClaudeDesktop.exe was a real JetBrains program

The file that landed was named ClaudeDesktop.exe, and Huntress found that it was not attacker-written code at all. It was jcef_helper.exe, a genuine component of JetBrains' Chromium embedding framework, renamed. A real program, from a real software company, carrying a real code signature.

The malicious part travelled beside it as libcef.dll, a library the JetBrains binary legitimately expects to load from its own folder. Windows obliges. The signed executable starts, reaches for the DLL next to it, and loads the tampered one. This is DLL sideloading, and its whole purpose is to make the process that runs the malware look, to any signature check and to any casual glance in Task Manager, like software from a company you have heard of.

A second copy was written to disk as DockerDesktop.exe and wired to a scheduled task, so that the machine reinfects itself after a reboot or a partial cleanup. The naming is not accidental either. A file called DockerDesktop.exe on a developer's laptop invites nobody to ask questions.

If that shape feels familiar, it should. The OkoBot stealer chain we documented used the same instinct, shipping a fake SQL Server Management Studio installer that was really a repackaged copy of Audacity. Hiding inside a legitimate, signed application is now the default, not the clever exception.

What SectopRAT takes once it is running

SectopRAT is not new. Darktrace's write-up dates it to early 2019, describes it as a .NET remote access trojan with information-stealing capabilities, notes the alias ArechClient2, and says it is "commonly distributed through drive-by downloads of illegitimate software and utilizes malvertising, including via Google Ads, to increase the chances of it being downloaded." Seven years on, that description still fits the campaign it arrived in, with one search engine swapped for another.

What it collects, per Huntress and BleepingComputer's July 23 report: browser logins, cookies and autofill data, saved credit cards, Chromium key material, FTP credentials, messaging clients including Discord and Telegram, Steam, and VPN client data. Darktrace's analysis of the same family adds cryptocurrency wallet details and system hardware information to that list.

The capability that matters most is the one that sounds most technical. SectopRAT includes HVNC, hidden virtual network computing, which spins up a second desktop the user never sees and lets the operator drive the browser sessions on it. Consider what that defeats. Your password is long and unique. Your account has two-factor authentication. None of that is consulted again, because the session on that hidden desktop is already signed in, using the cookies that were already on the machine. Stolen session cookies are why "I have 2FA" is not the end of the conversation, and why the recovery step people skip, signing out every session everywhere, is the one that actually matters.

The command server address was written onto a blockchain

Most malware has to be told where to phone home, and that instruction is the weak point: a hard-coded domain gets seized, a hard-coded IP gets null-routed. This campaign used a technique researchers call EtherHiding. Instead of carrying its command-and-control address, the malware reads it out of transaction data attached to smart contracts on a public blockchain.

The consequence is simple and unhappy. There is no registrar to send a takedown to and no host to complain to, because the lookup target is a public ledger that cannot be edited or removed. Rotating to a new command server costs the operator one transaction fee. Huntress examined the contract addresses involved and concluded that the infrastructure reachable through them "extends far beyond the current event."

This operator did not start in July

Two days of activity looks opportunistic. The registration record says otherwise. Huntress tied a single registrant email address to ten distinct domains going back to December 2025, and connected the same operator to a comparable campaign in April 2026 that used a Docker Hub theme rather than a Claude one. One of those older domains had already been identified by Microsoft as hosting the StealC stealer and taken out of circulation under Operation Endgame, the international effort to disrupt malware distribution.

So the correct way to read FakeAgent is not as an isolated incident but as one run of a working process: pick a product people are searching for, buy the sponsored slot, find a first-party surface that will host your page for you, and let the platform's reputation carry the click. The next run will not be about Claude. That is the point of building it this way. It is the same industrial pattern behind search-engine phishing through paid ads and behind the sponsored-ad wallet drainer we took apart in May.

Five checks that still work when the domain is genuine

The usual advice collapses here, so these are written for the case where the address bar is telling the truth and the page is still a trap.

1. Get installers from the product's own download page, typed by hand. The Claude desktop app is distributed from claude.com/download. Typing claude.ai and going to /download sends you to the same place, because claude.ai/download redirects there. Anthropic owns claude.ai, claude.com and anthropic.com, and it is worth knowing all three so a legitimate redirect between them does not read as suspicious. A search result is a suggestion, not a source.
2. Read the path, not just the domain. A vendor's official download does not live under /public/artifacts/, /share/, /d/ or any other user-content path. If the URL on a first-party domain has a random identifier in it, you are looking at something a user published, not something the company shipped.
3. Watch where the Download button goes. Hover it, or check the address after it fires. A real vendor download stays on vendor or CDN infrastructure. Being handed to a domain you have never seen, twice in a row, in under a second, is the event worth reacting to.
4. Read hostnames right to left. Ownership lives immediately left of the top-level domain. In claude.ai.download-app[.]us, the owner is download-app[.]us. Everything before it is decoration, and it is free.
5. Treat sponsored results as unverified. The ad slot is bought, and this campaign proves a bought slot can display a real domain and still land somewhere harmful. Scroll past to the organic result, or skip search entirely and type the domain. The same instinct protects against the fake browser update prompt, which is the other place people run an installer they did not go looking for.

If you already ran ClaudeDesktop.exe

Treat this as credential theft that has already happened, not as a file to delete. The order matters more than the speed.

• Get the machine off the network and leave it off. If it is a work device, tell your IT or security team immediately and stop there. Twenty-nine organizations were compromised through this campaign, which means this is a corporate incident pattern, and your security team wants the machine as it is.
• Move to a different, clean device for everything that follows. Changing passwords from the infected machine hands the new ones straight to whoever is watching.
• Change passwords, then revoke every session. Cookies were taken, so a new password alone leaves the attacker signed in. Every major service has a "sign out of all devices" or "revoke active sessions" control. Use it on email first, because email is the reset path for everything else.
• Move crypto before anything else if wallets were on that machine. Create a fresh wallet on a clean device, ideally a hardware wallet, and transfer the balance. A seed phrase that was ever stored, screenshotted or pasted on the infected machine is not yours alone anymore.
• Assume persistence and rebuild. A scheduled task pointing at DockerDesktop.exe was designed to survive cleanup. Removing one file is not remediation. A full reinstall of the operating system is the answer you can rely on.
• Report it. In the United States, the FBI's Internet Crime Complaint Center at ic3.gov and the FTC at reportfraud.ftc.gov. Our guide to the first 24 hours after a scam covers the full lockdown order.

How SafeBrowz reads a chain like this one

SafeBrowz runs a 3-layer detection architecture: Local + APIs + AI. Being straight about where each layer sits in this particular chain is more useful than a list of capabilities.

• Layer 1, Local detection: 60+ URL patterns and a 550+ brand database check the hostname in the browser before the page renders. Anthropic is a tracked brand and claude.ai is recorded as its real domain, so the artifact URL comes back safe. That is the right answer for a domain Anthropic owns, and we are not going to break it. The shape this layer is built for is the next one: a brand string welded in front of an unrelated registrable domain, which is exactly what claude.ai.download-app[.]us is.
• Layer 2, API checks: the domain is cross-referenced server-side against Google Safe Browsing, PhishTank, URLhaus and ScamAdviser feeds, a 30+ scam TLD watchlist, and our own blocklist. Our own indicator list sits alongside those feeds and absorbs published research, which is how this campaign's redirect host returns a danger verdict today. It is also the layer with the honest timing problem: a campaign that runs for two days and stops can finish before any feed catches up.
• Layer 3, AI deep scan (Premium): AI content analysis via our proxy reads the page rather than the name. A Claude-branded download page whose primary button leaves the domain, offering a Windows installer for a product that Anthropic distributes from claude.com/download, is a combination that earns a verdict on a host registered this morning. On this campaign's redirect host it flags brand impersonation on its own, without needing the domain to be on any list first.

Now the limits, because this campaign has two that a URL scanner cannot argue its way out of. The first is a timing problem dressed up as a detection one. The payload host at the end of the chain carries no brand and sits under an established registrable domain, so there is nothing in the name to read. It returns danger for you today because the research is public and the host is on our indicator list, which is exactly the kind of after-the-fact protection that was worth nothing to the people who clicked during the two days it was live. The brand-borrowing hop one step earlier is the one a name-based check could catch in real time, which is why that hop, not this one, is where a browser layer earns its place. The second limit is blunter: nothing in a browser extension stops an executable that has already been saved and double-clicked. Once ClaudeDesktop.exe runs, you are in endpoint and incident-response territory. What a browser layer buys is the seconds before the save dialog, on the hop where the brand-borrowing hostname appears, which was a real chance to stop this one.

Detection signatures are derived from threat-intelligence research and our internal brand database, not from user browsing data. SafeBrowz does not store per-user browsing history.

Frequently asked questions

Was claude.ai hacked?

No. Nothing was breached and no Anthropic system was compromised. The attacker used Artifacts the way any user can: Claude produced a page, the attacker published it, and public artifacts are served from an address under claude.ai. So the malicious page was genuinely hosted on Anthropic's domain without anyone breaking into anything. Huntress reported the artifact and Anthropic had removed it by July 22, 2026. The uncomfortable part is not a security hole, it is that first-party hosting of user-generated content lends the platform's reputation to whatever a stranger uploads.

Is there a real Claude desktop app, and where do I get it?

Yes. Anthropic ships an official Claude app for macOS, Windows and Linux, with a ChromeOS option listed on the same page, the Linux build being in beta, and the download page is claude.com/download. Typing claude.ai yourself and going to /download reaches the same page, because claude.ai/download redirects to claude.com/download. Anthropic owns claude.ai, claude.com and anthropic.com, and it is worth knowing all three so that a legitimate redirect between them does not look like a hijack. Anthropic is the only source of the official Claude Desktop build, whether you take it from claude.com/download or from its own apt repository for Linux. Community repackages and unofficial wrappers exist, but none of them is Anthropic's build, so a Claude installer offered from a domain that does not belong to Anthropic is not the real thing.

How could a stranger publish a page on claude.ai?

Artifacts is a Claude feature that produces self-contained content such as documents, diagrams and small working web apps, and it supports public sharing. A shared artifact is served from claude.ai/public/artifacts/ followed by a random identifier, which means the page sits on Anthropic's domain even though a user created it. Anthropic labels these pages with the line "Content is user-generated and unverified," but the notice is a short sentence in a corner while the artifact itself can fill the screen with a convincing replica of an official product page.

What does SectopRAT steal?

SectopRAT, also tracked as ArechClient2 and first observed in 2019, is a .NET remote access trojan with infostealer functions. Researchers list browser logins, cookies and autofill data, saved credit cards, Chromium key material, FTP credentials, messaging clients including Discord and Telegram, Steam accounts, VPN client data and crypto wallet data. It also includes HVNC, a hidden desktop the victim never sees, which lets the operator use already-authenticated browser sessions directly. That last capability is why two-factor authentication does not close the incident on its own, and why revoking every active session matters as much as changing passwords.

I clicked the ad but I do not think I installed anything. Am I fine?

Probably, but confirm rather than assume. Opening the artifact page alone did not infect anyone; the infection needed you to press Download and then run the file. Check your Downloads folder for ClaudeDesktop.exe and your system for a DockerDesktop.exe, and look at your scheduled tasks. If either file exists, treat the machine as compromised, get it off the network, and if it belongs to an employer tell your security team before doing anything else. If nothing was saved and nothing was run, you are in the clear, though it is a good moment to install the real app from claude.com/download.

Last updated 2026-07-26