FakeAgent: How Hackers Hid Malware Inside a Real Claude.ai Link
The link really was claude.ai. That’s what made it work. Security researchers found that attackers used a legitimate Anthropic feature to publish a fake download page on Claude’s own domain — and Bing sponsored ads sent victims straight to it.
How this was reported: This article is based on the original technical disclosure published by Huntress on July 22, 2026, including their full analysis and indicators of compromise. It is supplemented by reporting from BleepingComputer, Help Net Security, The Hacker News, and IT Security Guru. Technical details are drawn directly from Huntress’s published research.
What Actually Happened
Between July 21 and July 22, Huntress’ Security Operations Center noticed something odd: a wave of unusual executable installs, security-tool exclusions, and persistence mechanisms across 29 separate organizations, all tracing back to a file called ClaudeDesktop.exe. Every affected organization had the same starting point. An employee had searched for the Claude desktop app, clicked a result, and ended up somewhere that looked completely legitimate — because it was.
The malicious page wasn’t a lookalike domain with a swapped letter or an extra hyphen. It was hosted directly on claude.ai, Anthropic’s real domain. Huntress named the campaign FakeAgent, and traced the entire chain back to a feature most Claude users have encountered without a second thought: Artifacts. It’s the second time in a matter of days that Wangdoo has covered attackers weaponising trust in AI tooling specifically — see our recent piece on AgentBaiting and the FakeGit campaign, where fake AI Skills and MCP servers were built specifically to be recommended by AI coding agents rather than found by humans directly.
What a Claude Artifact Actually Is — and How It Got Abused
Artifacts are a legitimate Claude feature. They let a conversation with Claude produce something more substantial than a chat reply — a small web page, a chart, a document, a working code demo — displayed in its own panel. Critically, a user can also publish an Artifact to a public link, so anyone can view it without needing a Claude account of their own. Every public Artifact carries a disclaimer, visible on the page itself: “Content is user-generated and unverified.”
That disclaimer is honest, and it’s also exactly the gap this attack exploited. Someone built an Artifact designed to look precisely like Claude Desktop’s official download page, published it publicly, and got it indexed well enough to appear as a sponsored Bing result when people searched “Claude desktop app.” The ad itself displayed the real claude.ai URL — because it was real. Clicking through led to claude[.]ai/public/artifacts/ca456f1f-44c0-42af-b329-4f1c7534a877, a page built to be visually indistinguishable from Anthropic’s actual download page.
A closely related campaign pattern — fake download sites seeded to look legitimate, stealing saved browser passwords and session cookies the same way SectopRAT does. Independent production, not affiliated with Wangdoo.
Only the “Download” button was live. Clicking it sent visitors off the trusted claude.ai domain entirely, first to claude.ai.download-app[.]us — a domain registered May 9, 2026 specifically to look like part of Anthropic’s infrastructure — and then to a second address that finally served the malicious file: a fake ClaudeDesktop.exe.
Why the domain mattered so much here
Standard advice for spotting a fake download is to check the URL. This attack was specifically built to survive that check. Huntress put it plainly in their own conclusions: “Do not trust top-level domains implicitly.” A real claude.ai link took people to a fake product. The domain check people are trained to rely on gave a false sense of security at exactly the moment it mattered most.
Inside the Malware: A Chain Built to Resist Analysis
What downloaded wasn’t actually ClaudeDesktop.exe at all — it was a renamed copy of a legitimate JetBrains component (jcef_helper.exe) sitting beside a tampered DLL file, libcef.dll. This is a well-known technique called DLL sideloading: a trusted, digitally signed program is used to load a malicious file that’s been placed right next to it, letting the attacker’s code run inside the context of software that looks completely legitimate to security tools.
That tampered DLL was where things got notably unusual. Huntress found it packed with VMProtect, commercial software-protection tooling that attackers commonly abuse specifically because it makes reverse-engineering brutally slow. Buried inside, they also found a reference to an Ethereum smart contract address. Calling that contract didn’t move any cryptocurrency — it returned an encrypted response that pointed the malware toward its next stage. This technique has a name in the security industry: EtherHiding. Rather than hardcoding a server address that defenders can simply block, the attacker can rotate their infrastructure at will just by posting a new transaction to the blockchain, making the command-and-control channel extremely difficult to take down.
A second, separate persistence mechanism was dropped alongside the first: a file disguised as an IBM SPSS statistical analysis tool, which used the same DLL sideloading trick to load another malicious component. This one skipped VMProtect but added something Huntress described as unusually difficult to defeat — a check that examined the system’s graphics hardware before deciding whether to actually run. If the malware detected signs of a virtual machine — specific hardware IDs associated with QEMU or VMware, or unusually small video memory — it simply refused to execute. Security researchers analyzing malware routinely do so inside virtual machines specifically to contain it safely; this check was built to spot that environment and go quiet rather than reveal itself.
Decryption handled by the graphics card, not the processor
The most unusual technical detail in Huntress’s writeup: the final payload wasn’t decrypted using a normal software routine that antivirus tools know how to watch for. It was decrypted by a compiled DirectX shader — code designed to run on the graphics card, not the CPU. Standard reverse-engineering tools are built to analyse CPU instructions; GPU shader code sits largely outside what they can automatically interpret, which let this specific decryption step operate in a blind spot most security tooling doesn’t cover.
Once fully unpacked, the payload resolved to SectopRAT — a remote access trojan built to harvest saved browser passwords, cookies, credit card details, autofill data, and credentials from messaging clients like Discord, along with general system information. With the live command-and-control address finally decrypted, Huntress confirmed the address actively receiving stolen data: 2.24.131[.]246.
An Unusual Twist: Researchers Used Claude to Analyse the Attack on Claude
The most striking detail in Huntress’s own account isn’t about the attacker — it’s about their own investigation. Faced with that GPU-based shader decryption routine, which resisted normal analysis, Huntress turned to Claude Opus 4.8 to help reconstruct the cryptographic logic hidden inside the shader code, working through it as an AES-256 variant with a non-standard modification.
The process wasn’t clean. Claude’s first attempt at decryption failed. Huntress and the model worked through it iteratively — rebuilding a custom bytecode interpreter, cross-checking assumptions, and eventually tracing the failure to a single incorrectly transcribed byte in the encryption key. Huntress were candid about this in their own writeup, noting plainly that manual human verification was what ultimately found the error. It’s a small, honest detail buried inside a much larger disclosure: AI tooling meaningfully accelerated a complex reverse-engineering task here, but it didn’t replace the need for a human checking its work.
The Attacker Has Been Doing This for Over a Year
Huntress didn’t stop at unpacking the malware — they traced the infrastructure behind it. Using public domain registration records and threat-intelligence tooling, they linked the registration email behind download-app[.]us to ten separate malicious domains dating back to December 2025. One of those had already been seized by Microsoft as part of Operation Endgame, an international law enforcement effort against malware distribution infrastructure, after being identified as hosting a related information-stealer called StealC.
The same operator, Huntress found, ran a nearly identical campaign back in April 2026 — that time distributing fake Docker Desktop installers through Docker Hub, using the same core sideloading trick. And by decrypting the full history of command-and-control addresses tied to the attacker’s Ethereum wallet activity, Huntress traced this specific infrastructure’s operational history back to a first transaction on May 30, 2025 — meaning this isn’t a new operator experimenting with AI-branded lures. It’s an established operation that has simply moved on to targeting whichever software people are currently searching for, and right now, that’s AI tools.
Anthropic’s Response and What Happens Now
Huntress reported the malicious Artifact to Anthropic, and it was taken down before Huntress published their findings on July 22 — though not before accumulating 7,100 page views. Huntress also noted this isn’t an isolated incident; they referenced a previous, similar campaign abusing fake Claude downloads that they’d documented separately. The pattern is now familiar enough that Huntress flagged it as “strikingly common.”
There’s no indication in Huntress’s report of a technical flaw being patched, because there wasn’t really a vulnerability in the traditional sense — Artifacts worked exactly as designed. The gap here is closer to a policy and moderation challenge: a platform that lets any user publish content to a trusted domain creates an opportunity for that trust to be borrowed by anyone willing to build something convincing enough.
What You Actually Need to Do
Practical checklist
1. Don’t trust a domain just because it’s correct. This is the single clearest lesson from the disclosure. A technically correct top-level domain does not guarantee official content, when the platform itself allows user-published pages.
2. Skip sponsored search results for software downloads entirely. Go directly to a company’s known official site, or a bookmark you’ve saved previously, rather than searching and clicking the first paid result.
3. Be suspicious of any installer that behaves unusually. A legitimate download shouldn’t be flagged for antivirus exclusions, register unexpected scheduled tasks, or spawn a second identically named executable elsewhere on the system.
4. If your organisation was affected, don’t assume a password reset is sufficient. SectopRAT is built to steal stored credentials and active session data — treat any suspected infection as a full credential-compromise event, not a single-password incident.
5. Report suspicious Artifacts or similar user-generated content you encounter. Huntress’s own reporting is what got this specific page removed; platform moderation depends partly on exactly this kind of user reporting.
My Take — Mr Wangdoo
The detail I keep returning to in this disclosure isn’t the malware itself — SectopRAT is a known quantity, and the sideloading trick that delivered it isn’t new. It’s the fact that Huntress’s own advice boils down to something uncomfortable: the domain check doesn’t work anymore, not reliably, against this specific category of attack. For years, “check that the URL is actually the real site” has been close to the single most repeated piece of security advice given to ordinary users. This campaign is a clean demonstration of a platform category — any service that lets users publish content to a trusted domain — where that advice quietly stops holding.
I also think the Claude-analysing-Claude-malware detail deserves more attention than it’s likely to get, because it’s an honest data point about where AI-assisted security research currently stands. Huntress didn’t oversell it. The model accelerated a task that would have taken far longer by hand, got most of the way there, made an error, and a human caught it. That’s a realistic, useful picture of AI-assisted defensive work right now — not the fully autonomous analyst some coverage of “AI in cybersecurity” implies, and not a gimmick either. Genuinely useful, imperfect in practice, and still requiring a person paying close attention.
The broader pattern across Huntress’s own findings — a single operator running variations of this same trick against Claude, then Docker, since at least mid-2025 — is the part worth sitting with longest. This wasn’t built specifically to exploit AI hype. It’s a generic, well-practised playbook that gets pointed at whatever software people are currently searching for in large numbers. Right now that’s AI tools. The lesson isn’t really about Claude specifically — it’s that any sufficiently popular piece of software, on any platform that allows user-generated content on its own domain, is a candidate for exactly this attack. It’s the same underlying theme we saw in our coverage of the OpenClaw WhatsApp exploit: the tools themselves aren’t the weak point. The trust people place in a familiar interface is.
Frequently Asked Questions
What is FakeAgent?
FakeAgent is the name Huntress gave to a malvertising campaign discovered in July 2026, in which attackers published a fake Claude Desktop download page as a public Claude Artifact — content hosted directly on Anthropic’s own claude.ai domain. Victims who searched for “Claude desktop app” on Bing and clicked a sponsored result were led to this page, then redirected off-domain to download SectopRAT, an information-stealing malware, disguised as the real installer.
What is a Claude Artifact and why could it be abused this way?
Artifacts are a legitimate Claude feature that let a conversation produce standalone content — a webpage, chart, or document — displayed separately from the chat. Users can publish an Artifact to a public link that anyone can view, and every public Artifact carries a disclaimer noting the content is user-generated and unverified. Attackers exploited this by publishing an Artifact built to look exactly like Anthropic’s genuine Claude Desktop download page, hosted on the real claude.ai domain by design of the feature itself.
What does the SectopRAT malware actually do?
SectopRAT is a remote access trojan that harvests saved browser passwords, cookies, autofill data, credit card information, and credentials from messaging applications, then sends this data back to attacker-controlled infrastructure. In this campaign, its command-and-control address was hidden using a technique called EtherHiding, where instructions are retrieved via an Ethereum blockchain smart contract rather than a conventional server, making the infrastructure harder to take down.
Is this a security flaw that Anthropic needs to patch?
Not in the traditional sense. The Artifacts feature functioned as designed — the issue is that a platform allowing user-published content on a trusted domain inherently creates an opportunity for that trust to be borrowed for malicious purposes. Anthropic removed the specific malicious Artifact once Huntress reported it, but the underlying capability that made the attack possible is the same one that makes Artifacts useful for legitimate purposes.
How can I tell if I’ve been affected by SectopRAT or a similar infostealer?
Warning signs include unexpected executables you don’t recall installing, unusual Windows Defender exclusions you didn’t create, unfamiliar scheduled tasks, or a second suspiciously similar file elsewhere on your system. If you suspect infection, the safest response is a full credential reset across all accounts accessed from that device — including revoking active browser sessions and any saved payment methods — rather than assuming a simple password change is sufficient, since infostealers like SectopRAT are built to capture active session data as well as stored passwords.
Is it safe to download Claude Desktop now?
Yes, provided you go directly to Anthropic’s official site rather than clicking a search engine advertisement. The specific malicious Artifact identified in this campaign has been removed. The broader risk — sponsored search results leading to convincing fake download pages, including ones hosted on legitimate platform domains — is an ongoing category of attack that isn’t unique to Claude, and applies to popular software generally. For wider context on how attackers are increasingly building tools specifically to exploit AI systems, see our coverage of the Q2 2026 ransomware report, which found AI is now routinely used to accelerate attacks well beyond this single campaign.
Sources
- Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT — Huntress, July 22, 2026 (primary source: full technical analysis, IOCs, attribution research)
- Fake Claude app promoted by Bing ads pushes SectopRAT malware — BleepingComputer, July 22, 2026 (Operation Endgame connection, prior April 2026 Docker campaign)
- How attackers hosted a fake Claude download page on the claude.ai domain — Help Net Security, July 23, 2026 (Artifacts feature explanation, Anthropic takedown timeline)
- ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories — The Hacker News, July 22, 2026 (campaign confirmation and broader threat roundup context)
- FakeAgent Campaign: Malicious Claude Artifact Used to Distribute SectopRAT to 29 Organisations — IT Security Guru, July 23, 2026 (attacker infrastructure trend analysis)
