{"id":"fake-claude-desktop-malware-jul-2026","category":"scam","status":"closed","title":"Fake Claude Desktop adverts install SectopRAT password-stealing malware in FakeAgent campaign","tldr":"Fake Claude Desktop search adverts infected Windows PCs with password-stealing malware. Anthropic removed the lure, but related incidents continued into August. Download Claude only from its official page; seek help if you ran the fake installer.","summary":"FakeAgent targeted Windows users searching Bing for Claude Desktop. Sponsored results sent them to a fake download page published as a user-created Claude Artifact on the genuine claude.ai domain, then to an external installer. Huntress observed victims at at least 29 organisations on 21–22 July. The installer delivered SectopRAT, malware capable of remote control and stealing passwords, payment card details, personal information and files. According to Huntress, Anthropic removed the Artifact by 22 July. A September follow-up written by Huntress said incidents associated with the same redirect domain continued into August. This was a fake-download scam, with no Claude version update identified as its remedy. As at 3 November, the sources reviewed do not establish that the campaign has ended or that all infected computers have been cleaned. No incident-specific public statement from Anthropic was found.","action":"Download Claude through https://claude.com/download rather than a search advert or public Artifact. If you ran the fake installer, disconnect that Windows PC from the internet and ask your IT team or a trusted technician to remove the malware. From a clean device, change exposed passwords, revoke signed-in sessions and contact your bank if payment card details may have been exposed.","product":"Windows PCs running a fake Claude Desktop installer","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["claude","windows","malvertising","fakeagent","sectoprat","credential-theft"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"research","title":"Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT","url":"https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat","by":"Huntress","date":"2026-07-22"},{"kind":"post","title":"Download Claude","url":"https://claude.com/download","by":"Anthropic","date":""},{"kind":"news","title":"ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories","url":"https://thehackernews.com/2026/07/threatsday-android-spyware-plc-attacks.html","by":"The Hacker News","date":"2026-07-23"},{"kind":"news","title":"Fake Claude app promoted by Bing ads pushes SectopRAT malware","url":"https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/","by":"BleepingComputer","date":"2026-07-23"},{"kind":"post","title":"How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface","url":"https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/","by":"Huntress Labs, sponsored article on BleepingComputer","date":"2026-09-11"}],"started":"2026-07-21","closed":"2026-09-11","created":"2026-11-03T21:39:02.770Z","updated":"2026-11-03T21:39:02.770Z","cve_notes":[],"timeline":[{"at":"2026-09-11","added":"2026-11-03T21:35:43.306Z","kind":"wider-attacks","text":"In a follow-up written by Huntress Labs, the company said incidents linked to the same redirect domain continued into August despite the July takedown. It described the July impact as more than 29 organisations, without publishing a new exact total.","url":"https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/","by":"Huntress Labs, via BleepingComputer","patch":null},{"at":"2026-07-22","added":"2026-11-03T21:35:43.306Z","kind":"disclosed","text":"Huntress published its investigation and said Anthropic had removed the malicious Artifact after receiving its report. The page had accumulated 7,100 views before removal; these were page views, not confirmed infections.","url":"https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat","by":"Huntress","patch":null},{"at":"2026-07-21","added":"2026-11-03T21:35:43.306Z","kind":"other","text":"Huntress began observing FakeAgent infections, affecting at least 29 organisations over 21–22 July. Bing adverts led people seeking Claude Desktop through a malicious public Claude Artifact to an external fake installer.","url":"https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat","by":"Huntress","patch":"na"}],"url":"https://hard.fyi/live/fake-claude-desktop-malware-jul-2026/","json":"https://hard.fyi/api/live?id=fake-claude-desktop-malware-jul-2026"}