Someone Turned Claude.ai's Own Platform Into Malware Bait - Here's What Actually Happened

I've covered a lot of malvertising campaigns, and most of them rely on a fake domain designed to look almost right - a misspelled URL, a slightly off logo, something a careful person might catch. This one skipped that step entirely. Attackers behind a campaign called FakeAgent got their malicious download page hosted directly on Anthropic's real claude.ai domain, using a legitimate platform feature against itself, and used it to infect at least 29 organizations in a single two-day window before it was caught. The detail that makes this genuinely strange: the security researchers who caught it used Claude itself to help take the malware apart. The direct answer: Between July 21 and 22, 2026, attackers ran a malvertising campaign called FakeAgent that used a sponsored Bing search ad and a malicious public Claude Artifact — hosted on the real claude.ai domain — to trick people searching for the Claude desktop app into downloading a fake installer. The installer actually delivered SectopRAT, an information-stealing remote access trojan. Huntress, the security firm that discovered the campaign, reported the malicious page to Anthropic, which removed it. If you searched for and downloaded "Claude Desktop" via a search ad on July 21 or 22, you should check your system for signs of compromise. Quick Facts Detail Info Campaign name FakeAgent Active dates July 21-22, 2026 Organizations compromised At least 29 Attack vector Sponsored Bing search ad + malicious public Claude Artifact Hosting domain claude.ai (legitimate, via user-published Artifact) Malware delivered SectopRAT (also tracked as ArechClient2) Malicious page views before takedown 7,100 Discovered by Huntress Reported to Anthropic Yes — artifact removed same day as disclosure Malware type Information-stealing remote access trojan (RAT) with hidden remote-control capability How the Attack Actually Worked The starting point was ordinary: someone searches "Claude desktop app" on Bing and clicks a sponsored result near the top of the page. Normally, spotting a malicious ad means noticing a slightly wrong URL. This campaign avoided that entirely — the ad pointed to the real claude.ai domain, because the malicious content wasn't a fake domain at all. It was a public Claude Artifact. Artifacts are a legitimate Claude.ai feature that renders content like code, documents, or interactive pages in a panel alongside a conversation, and Anthropic allows users to publish artifacts to a public link that anyone can view without needing a Claude account themselves. Attackers built an artifact designed to look exactly like Claude's official desktop app download page and published it publicly. Because it was genuinely hosted on claude.ai, it passed the one check most security-conscious users actually perform: looking at the domain in the address bar. Clicking "Download" on the spoofed page redirected visitors through a chain of attacker-controlled domains before ultimately serving a file called ClaudeDesktop.exe. That file wasn't what it claimed to be. According to Huntress's analysis, the download package bundled a legitimate, signed component from an unrelated software company alongside a tampered file that hijacked it through a well-documented technique called DLL sideloading — essentially tricking a trusted, legitimately-signed program into loading a malicious file instead of the component it expected. A separate file, misleadingly named DockerDesktop.exe, was also dropped and registered as a scheduled task, which let the infection persist and reactivate even after a system restart. The whole package was wrapped in commercial anti-reverse-engineering software and included checks for virtual machine environments — common techniques malware uses to avoid running inside a security researcher's test environment and to slow down analysis generally. What SectopRAT Actually Does The malware ultimately delivered is called SectopRAT, also tracked under the name ArechClient2, an information-stealing remote access trojan that's reportedly been active since 2019. It includes Hidden Virtual Network Computing (HVNC) functionality, which lets an attacker interact with a compromised computer in real time without the actual user seeing anything unusual happening on their own screen. Beyond that hands-on access, it's built to harvest browser-saved passwords, autofill data, payment card information, files, cookies, FTP credentials, and login data from messaging platforms including Discord and Telegram, along with gaming and VPN credentials. Command-and-control infrastructure for this campaign was reportedly concealed using a technique called EtherHiding — hiding server addresses inside Ethereum blockchain transactions rather than relying on conventional servers that security researchers and takedown services can identify and block. That's a meaningfully more resilient setup than older malware infrastructure, since blockchain transactions aren't something a hosting provider or domain regist