Researchers at Huntress have disclosed a malvertising campaign that abused a public artifact hosted on Anthropic’s own claude.ai domain to distribute the SectopRAT information-stealing Trojan, compromising at least 29 organisations in the space of two days.
The campaign, which Huntress has named FakeAgent, ran between 21 and 22 July 2026. Victims searching for “Claude Desktop app” on Bing were served a sponsored advertisement that, unlike the surrounding malicious ads, pointed to the legitimate claude.ai domain. However, the link led not to Anthropic’s genuine download page but to a public Claude Artifact, user-generated content that Anthropic allows users to host and share on its platform, that had been built to imitate the official Claude Desktop installer.
Clicking “Download” on the spoofed artifact redirected victims through a chain of attacker-controlled domains, including claude.ai.download-app[.]us, before serving a malicious ClaudeDesktop.exe file. Huntress reported the artifact to Anthropic, which removed it on 22 July, by which point the page had recorded more than 7,100 views.
Sideloading and anti-analysis tradecraft
According to Huntress’ technical writeup, the malicious executable was not actually the Claude Desktop installer but a repurposed JetBrains binary (jcef_helper.exe) vulnerable to DLL sideloading. The real payload was carried in a tampered libcef.dll, packed with the commercial protector VMProtect to hinder reverse engineering.
A second stage, delivered via a signed IBM SPSS binary and a malicious tempdir.dll, implemented a GPU-based anti-analysis check that inspected DirectX graphics adapters for signatures associated with virtual machines (such as those used by QEMU and VMware) and measured shader execution timing before deciding whether to run.
Notably, the malware’s core payload was decrypted using a custom DirectX shader rather than a conventional CPU-based routine, a technique Huntress said is largely opaque to standard reverse-engineering tooling. Investigators said they used Claude Opus 4.8 to help reconstruct an SM5 bytecode interpreter and recover the AES-256-CTR key material used by the shader, work that ultimately uncovered the malware family: SectopRAT, a remote access trojan designed to harvest browser credentials, autofill data, payment card details and files.
Command-and-control infrastructure for the malware was concealed inside Ethereum blockchain transactions, a technique known as “EtherHiding” that allows operators to rotate infrastructure by posting new transactions rather than relying on takedown-vulnerable servers.
Attribution and prior activity
Huntress used WHOIS and threat-intelligence data from Validin to link the registration email address behind the campaign’s infrastructure to at least ten other domains dating back to December 2025, including one seized by Microsoft as part of Operation Endgame for hosting the StealC stealer. Researchers also tied the operator to an earlier campaign, identified in April 2026, that used a similarly themed fake Docker Desktop installer distributed via Docker Hub.
Huntress said its analysis of the Ethereum-based command-and-control transactions traces the operator’s activity back to May 2025.
Industry implications
The incident underscores a growing trend of attackers targeting AI tooling platforms directly rather than relying solely on typosquatted domains. Huntress noted that this is not an isolated case, pointing to a previous report on a similar fake Claude download campaign.
“Do not trust top-level domains implicitly,” Huntress wrote in its findings, urging users to treat search-engine advertisements with caution regardless of the domain they claim to represent, given the long-running prevalence of SEO poisoning and malvertising as an initial access vector.
The full technical analysis, including indicators of compromise and a list of historical command-and-control IP addresses extracted from the blockchain transactions, is available on the Huntress blog: https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat
