FakeAgent, a fresh malvertising campaign tracked by Huntress, used sponsored Bing results and a public Claude Artifact hosted on the real claude.ai domain to push a fake Claude Desktop installer. Huntress says the activity hit at least 29 organizations between July 21 and July 22, 2026, after users searched for the Claude desktop app and followed an ad that looked safer than usual because the first visible landing point was a legitimate Claude domain.1
The trust trick is the important part. The page was not an official Anthropic download page; it was a user-published Claude Artifact that rendered a convincing download portal and carried the normal artifact warning that the content was user-generated and unverified. Huntress reported the artifact to Anthropic, and it was removed before publication of the research, but the page had already reached about 7,100 views.1 Help Net Security separately summarized the same chain and noted that users could view the public artifact without a Claude account, making the fake page easy to share and index through ads.3
Clicking the fake download button redirected victims away from Claude to attacker-controlled infrastructure, including the defanged domains claude.ai.download-app[.]us and downloading-api.it[.]com/html/claude/win. The downloaded file was named ClaudeDesktop.exe, but Huntress found that it was actually a JetBrains Chromium Embedded Framework component abused for DLL sideloading. The malicious payload lived beside it as a tampered libcef.dll.1
BleepingComputer reported that the malware chain delivered SectopRAT, also known as ArechClient2, a remote-access trojan with information-stealing and hidden remote-control capabilities. The campaign also dropped a DockerDesktop.exe component for persistence through a scheduled task, which fits Huntress’ observation that the same actor had earlier used fake Docker Desktop distribution patterns.2
For defenders, this is not just another fake-download story. The campaign blends three trust failures that are now common in AI-tool abuse: paid search placement, real platform hosting, and a familiar desktop-app name. It sits near earlier attacks where fake AI or developer resources were used to steal secrets, such as the FakeGit AgentBaiting campaign against GitHub and AI-tool workflows and the fake OpenAI Privacy Filter repository on Hugging Face.
What teams should check now
Start with endpoint telemetry for the names and paths that Huntress published, especially ClaudeDesktop.exe, DockerDesktop.exe, unexpected libcef.dll loads, and persistence under %APPDATA%RoamingMicrosoftEdgeUpdateInstallsslconf.exe. A legitimate Claude install path should not require a Bing ad, a public artifact page, or a redirect to a newly registered download domain. If users installed Claude Desktop during July 21-22 after searching the web, treat that host as worth checking even if the initial URL looked like claude.ai.1
Huntress also documented anti-analysis behavior, including VMProtect packing, GPU and VRAM checks, shader-based payload handling, and command-and-control information recovered through BNB Smart Chain transactions. The primary indicators include the removed Claude artifact path claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877, download-app[.]us, 2.24.131[.]246, BSC contracts 0xe012d0f34cde9b870e9d9ed566ea5f8fd9b92228 and 0xc1907d7be91f95903ad66d775c397302e7dd9228, plus hashes for the malicious tempdir.dll, libcef.dll, and embedded SectopRAT payload.1
Any confirmed execution should trigger normal infostealer response, not just file cleanup. Review browser passwords, cookies, credit-card autofill data, VPN clients, FTP tools, Discord, Telegram, Steam, and saved session material on the affected endpoint. Rotate exposed credentials from a clean machine, revoke active sessions where possible, and check cloud and Microsoft 365 accounts for suspicious sign-ins or token use. The same response mindset applies to recent ACR Stealer browser-token theft: removing the binary is only the first step if cookies, passwords, or remote-control access were exposed.
For prevention, organizations should tighten software-download guidance for AI tools. Bookmark official download pages in internal portals, warn users that a real top-level domain can still host user-generated or attacker-controlled content, and treat sponsored search results as untrusted until the final download path is verified. Security teams can also watch for new Defender exclusions, unexpected scheduled tasks, signed binaries loading unusual DLLs from writable folders, and user reports of AI tools downloaded from ads rather than vendor documentation.
References
- Huntress, “Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT,” July 22, 2026. huntress.com
- BleepingComputer, “Fake Claude app promoted by Bing ads pushes SectopRAT malware,” July 23, 2026. bleepingcomputer.com
- Help Net Security, “How attackers hosted a fake Claude download page on the claude.ai domain,” July 23, 2026. helpnetsecurity.com
Leave a Comment