Attackers Hosted Fake Claude Download Page on claude.ai Domain

A threat actor exploited Anthropic’s Claude Artifacts feature to trick users into downloading malware, according to researchers at Huntress. Over two days in July, employees at at least 29 organizations were compromised after searching for the Claude desktop app and clicking on a sponsored Bing ad.

The ad directed users to the legitimate claude.ai domain, but instead of landing on an official download page, victims were taken to an attacker-created public artifact. That artifact then redirected them to a spoofed download site serving the SectopRAT remote access trojan.

Claude Artifacts allow users to render content like code, documents, diagrams, or full web pages in a panel beside the chat. More critically, users can publish an artifact to a public link, enabling anyone to view it without a Claude account. In this attack, the artifact displayed a fully functional page that mimicked a legitimate Claude download page. Because it was hosted on the claude.ai domain, the illusion was nearly perfect. The only hint of its true nature was a small disclaimer in the upper left corner reading: “Content is user-generated and unverified.” That warning is easy to overlook.

Huntress reported the artifact to Anthropic, and it was taken down before the company published its findings on July 22. By that point, the page had been viewed 7,100 times.

When victims clicked the “Download” button, they were redirected to an external domain , first claude.ai.download-app[.]us and then downloading-api.it[.]com/html/claude/win , where they downloaded a malicious bundle. The bundle contained a renamed but legitimate signed JetBrains binary vulnerable to DLL sideloading, a tampered libcef.dll carrying the actual malware, and an executable named DockerDesktop.exe that was dropped to disk and registered as a scheduled task for persistent reinfection. The malware itself is SectopRAT, a remote access trojan that steals credit card data, personal information, files, and passwords.

Tracing the attacker required significant effort. Huntress researchers had to peel back multiple layers of defense on the payloads, using Claude itself to analyze them and uncover the command-and-control address. In the process, they found connections to earlier malware campaigns. WHOIS records and the Validin intelligence platform tied the download-app[.]us registration to an email address linked to ten domains dating back to December 2025. One of those domains, polse[.]us, was seized by Microsoft as part of Operation Endgame after being identified as hosting the StealC infostealer.

Huntress also linked the actor to an April 2026 campaign that used Docker Hub to distribute a fake Docker Desktop installer. That campaign employed the same libcef.dll sideloading trick and relied on a trusted domain to disarm suspicion. (This also explains the leftover DockerDesktop.exe filename in this month’s bundle.)

Their advice for users is straightforward: Do not implicitly trust search engine ads or top-level domains when searching for software to download. Threat actors have become highly skilled at pushing malicious ads through popular search engines and finding ways to host malicious content on legitimate platforms and domains.