Fake Claude app in Bing ads spreads SectopRAT

A fake Claude app promoted via malicious Bing ads was used to spread the SectopRAT remote access trojan. The campaign directed users to a fake download page for Claude Desktop and compromised at least 29 organizations between July 21 and 22, 2026.

The attackers exploited user-generated content on the legitimate domain claude.ai to build trust. Visitors were then redirected to external websites controlled by the attackers and distributed the SectopRAT malware.

The campaign has been named FakeAgent and is described in a technical analysis from security firm Huntress. The attackers published a fake download portal as a user-created Claude Artifact on Anthropic's legitimate domain.

The method made the campaign particularly convincing because the link in the sponsored Bing result actually led to claude.ai, thus presenting the fake Claude app as coming from a legitimate and trusted source.

Similar methods are used in so-called ClickFix attacks, where users are manipulated into downloading or running malicious files and commands themselves under the pretext of installing an update, resolving a technical issue, or verifying their identity.

This is not the first time cybercriminals have exploited the trust in Anthropic's AI service. The IT industry has previously reported on how Claude.ai was exploited in a malware campaign via Google Ads and if one fake Claude AI campaign that spread advanced malware.

Fake Claude app spread via Claude.ai

Huntress discovered that the malicious Claude Artifact content had received around 7,100 page views before Anthropic removed it.

The page was designed to mimic a legitimate download portal for Claude Desktop. When the user clicked the button to download the program, they were redirected to external domains controlled by the attackers.

Visitors were first directed to the domain claude.ai.download-app[.]us and then on to further infrastructure which delivered a file named ClaudeDesktop.exe.

The file appeared to be a legitimate installer for Claude Desktop, but in fact started an attack chain that led to the installation of SectopRAT.

ClaudeDesktop.exe was actually a renamed legitimate component from JetBrains named jcef_helper.exe. The component is based on the Chromium Embedded Framework and was placed together with a manipulated DLL file named libcef.dll.

The legitimate and signed component was used to load the manipulated DLL file. The technique is called DLL sideloading and involves tricking a trusted executable into loading malicious code from a DLL file placed in the application's path.

By misusing a legitimate application, attackers could make the activity look less suspicious, thereby making detection more difficult for traditional security solutions.

The manipulated DLL file was used to download and install SectopRAT, a remote access Trojan with extensive information theft capabilities.

Scheduled activity ensures persistence

To maintain access to the compromised system, the attackers used another executable file named DockerDesktop.exe.

The file created a scheduled task in Windows and could thus be started again to re-infect the computer. According to Huntress, ClaudeDesktop.exe and DockerDesktop.exe basically identical, but they are used in different parts of the attack chain.

The various payload and middleware components contained several features that would complicate security analysis and prevent the malware from running in virtual analysis environments.

Methods included VMProtect packaging, GPU and video memory checks, measuring how quickly DirectX shaders were executed, and identifying virtual machines and sandboxes.

Among other things, the malware could check if the system had less than 1 GB of video memory or if the graphics hardware contained characteristics associated with VMware, QEMU, and other virtualization platforms.

It also ran a time-based test of a compute shader. If the test ran abnormally fast, it could indicate that the program was being analyzed in an emulator or automated security environment.

If the system was deemed to be a virtual analysis environment, the malicious payload could refrain from running, thus allowing the attackers to avoid detection and analysis of the activity by security researchers.

SectopRAT steals passwords and payment details

SectopRAT, also known as ArechClient2, has been active since 2019. The malware combines information theft with HVNC functionality, Hidden Virtual Network Computing.

This means that the attacker can remotely control and interact with the compromised system in real time. At the same time, parts of the activity can be hidden from the user by the attacker working in a separate and invisible desktop session.

SectopRAT can collect user passwords, payment and credit card details, files, browser logins, cookies and auto-filled form data, among other things.

The malware can also steal FTP logins and information from messaging services like Discord and Telegram, as well as target Steam accounts and various VPN products.

Analysis of the decrypted .NET component revealed references to browser logins, cookies, credit card details, FTP services, and various messaging clients.

The researchers also identified functions to collect personal data and files from the infected system, which could then be sent to the attackers' command and control infrastructure.

Huntress assesses that the payload is SectopRAT or a closely related variant of the malware family.

Command and control address was hidden in the blockchain

The attack also used EtherHiding technology to retrieve current command and control addresses, so-called C2 addresses.

The information was stored in transactions and smart contracts on the BNB Smart Chain. By placing encrypted C2 information on a public blockchain, attackers could quickly switch servers and make the infrastructure more difficult to shut down.

Instead of hardcoding a permanent server address directly into the malware, the attacker could publish a new transaction pointing to a new C2 server.

The malware then read the information from the blockchain, decrypted it, and connected to the relevant server.

The technology created a resilient communication channel because it is difficult for security companies, internet service providers, and governments to remove or change information that has already been published on a public blockchain.

Huntress finally managed to identify an active C2 address by analyzing and decrypting the information stored in the BNB Smart Chain transactions.

Huntress used Claude in the analysis work

In an unusual twist, Huntress itself used Claude to analyze the campaign and bypass several of the malware's technical protections.

The AI model assisted security researchers with shader emulation, cryptographic function reconstruction, and analysis of heavily obfuscated .NET code.

Among other things, the researchers built their own interpreter for SM5 bytecode and recreated parts of the modified AES-256-CTR algorithm used to decrypt the malware's payload.

The malicious component used a DirectX shader for parts of the decryption process. By moving the work to the GPU, the attackers made analysis significantly more difficult for traditional tools that primarily examine CPU instructions and common cryptographic functions.

Analysis of the decrypted .NET payload allowed the researchers to identify the malware as SectopRAT or a closely related variant. The results also allowed researchers to map parts of the attackers' infrastructure.

Huntress also emphasizes the importance of human review. The AI model was able to assist with several technically advanced parts of the analysis, but researchers needed to manually check and correct the results before the payload could be decrypted and analyzed.

Ten domains were linked to the same email address

The researchers identified ten domains that had been registered with the same email address since December 2025.

At least one of the domains had previously been linked to the distribution of the information thief StealC and was seized in connection with the international operation. Operation Endgame.

Operation Endgame is an international effort targeting botnets, loaders, and other infrastructure used to distribute malware, steal information, and enable ransomware attacks.

Huntress was also able to link the registration details to a previous campaign where a fake installation of Docker Desktop was used to spread malware using similar methods.

Additionally, by analyzing transactions on the BNB Smart Chain, researchers were able to map command and control infrastructure stretching back to May 2025.

Microsoft has previously described how innovation and AI are being used to scale up international efforts against cybercrime.

However, Huntress does not have enough evidence to link the FakeAgent campaign to any specific and previously known threat actor or cybercriminal group.

Avoid sponsored download links

The incident shows that a legitimate domain does not automatically mean that all content on that domain is safe. User-generated content on trusted platforms can be misused to create convincing phishing and malware campaigns.

Users who need to download software should go directly to the vendor's official website and check the download link, instead of relying on sponsored search results.

Claude Desktop should only be downloaded via Anthropic's official installation instructions or the company's official download page.

Organizations should also use application control, endpoint protection, and clear rules for how software is allowed to be downloaded and installed on corporate devices.

Security teams should be alert to unusual software installations, new scheduled tasks, changes to Microsoft Defender settings, and legitimate applications loading unknown DLL files.

Particular caution should be exercised around ads offering downloads of popular AI tools, security software, browsers, and other commonly used applications.