Fake Claude app: the Bing ad led to Anthropic's real site

Anyone who searched for the Claude desktop app on Bing over the past few days could have picked up malware without making a single obvious mistake. The paid ad at the very top led to claude.ai, Anthropic’s real address. The trap was sitting right there.

Security firm Huntress published the case on July 22. At least 29 organizations were hit between July 21 and July 22. Huntress calls the campaign FakeAgent.

The fake page sat on Anthropic’s own domain

A feature called Artifacts made this possible. Claude uses it to render code, documents or entire web pages in a panel next to the chat. Artifacts can be shared publicly, and anyone can then open them without an account. The attackers built a working copy of the official download page that way, then bought a sponsored Bing ad pointing to it.

The only clue was a short line in the top left corner: "Content is user-generated and unverified." Anyone who checked the address bar instead saw claude.ai and clicked. The page racked up 7,100 views before Anthropic took it down after Huntress reported it.

The download button did lead off site after all, first to claude.ai.download-app[.]us and from there to downloading-api.it[.]com. The trick is in how the address is built. Here, claude.ai is only a subdomain sitting in front of the actual domain, download-app.us, which was registered on May 9.

A real file with someone else’s code inside

The ClaudeDesktop.exe that lands on the disk is not Claude software at all. It is a genuine, signed component from JetBrains that is open to DLL sideloading. DLL stands for Dynamic Link Library, a program library that an application loads when it starts. In a sideloading attack, the attacker drops a tampered copy of that library next to the clean program. The program loads it without question, and the malicious code runs under the good name of the signed file.

At the end of the chain sits SectopRAT, a remote access trojan that has been around since 2019. It grabs passwords, credit card details, files, browser logins and cookies, FTP credentials, data from Discord and Telegram, and Steam and VPN accounts. For lasting access, the campaign also drops a file called DockerDesktop.exe and registers it as a scheduled task, which reinfects the machine again and again.

The malware fights back against analysis. It is packed, and it checks the graphics card and video memory to spot virtual machines, the isolated test systems that security researchers use. Huntress says it used Claude Opus 4.8 for its own analysis, the predecessor of the recently released Claude Opus 5.

The trick is not new

Back in May, a fake Claude website was already pushing a Windows backdoor through Google ads. And in April, according to Huntress, the same actor used Docker Hub to spread a fake Docker Desktop installer built on exactly the same tampered library. That also explains why a file named DockerDesktop.exe was still sitting in this month’s bundle.

What you can take away from this

The address bar proves less than most people assume. Once a platform serves user-generated content under its own domain, and claude.ai, Google Docs and GitHub all do, the domain name says nothing about what you get. So software should not reach your machine through a search ad. Anthropic hands out the Claude apps at claude.com/download, and other programs belong on the maker’s own site, typed in directly or saved as a bookmark. Sponsored hits sit at the top because someone paid for them, not because anyone checked them.

If something slips through anyway, the second line of defense is what counts. An infostealer like SectopRAT goes straight for the credentials saved in your browser. We have written up how to secure your accounts so that a stolen password on its own is not enough.