{"id":224430,"date":"2026-07-25T09:00:12","date_gmt":"2026-07-25T06:00:12","guid":{"rendered":"https:\/\/digitrendz.blog\/?p=224430"},"modified":"2026-07-25T09:00:12","modified_gmt":"2026-07-25T06:00:12","slug":"attackers-hosted-fake-claude-download-page-on-claude-ai-domain","status":"publish","type":"post","link":"https:\/\/digitrendz.blog\/z\/tech-news\/224430\/attackers-hosted-fake-claude-download-page-on-claude-ai-domain\/","title":{"rendered":"Attackers Hosted Fake Claude Download Page on claude.ai Domain"},"content":{"rendered":"
\u25bc Summary<\/summary>

– A threat actor used a sponsored Bing ad for the Claude desktop app to redirect users to a malicious Claude Artifact, which then led to a fake download site serving the SectopRAT malware.
– Employees at 29 organizations were compromised in July 2025 after clicking the ad, which pointed to claude.ai but landed on an attacker-published artifact.
– The fake download page on Claude.ai appeared legitimate, with only a small “user-generated and unverified” disclaimer revealing its true nature; it was viewed 7,100 times before being taken down.
– The malware bundle included a legitimate JetBrains binary for DLL sideloading, a tampered libcef.dll carrying SectopRAT, and a persistent reinfection mechanism via a scheduled task.
– Huntress linked the attacker to previous campaigns using the same DLL sideloading technique, including an April 2026 Docker Hub campaign distributing a fake Docker Desktop installer.
<\/p><\/details>\n\n

<\/p>\n\n

A<\/mark> threat actor exploited Anthropic<\/a>\u2019s Claude Artifacts<\/a><\/strong> feature to trick users into downloading malware, according to researchers at Huntress<\/a>. Over two days in July, employees at at least 29 organizations<\/strong> were compromised after searching for the Claude desktop app and clicking on a sponsored Bing<\/a> ad.<\/p>\n\n

The ad directed users to the legitimate claude.ai<\/strong> domain, but instead of landing on an official download page, victims were taken to an attacker-created public artifact. That artifact then redirected them to a spoofed download site<\/a> serving the SectopRAT<\/a><\/strong> remote access<\/a> trojan.<\/p>\n\n

Claude Artifacts allow users to render content like code, documents, diagrams, or full web pages in a panel beside the chat. More critically, users can publish an artifact to a public link, enabling anyone to view it without a Claude account. In this attack, the artifact displayed a fully functional page that mimicked a legitimate Claude download page. Because it was hosted on the claude.ai domain<\/strong>, the illusion was nearly perfect. The only hint of its true nature was a small disclaimer in the upper left corner reading: \u201cContent is user-generated and unverified.\u201d That warning is easy to overlook.<\/p>\n\n

Huntress reported the artifact to Anthropic, and it was taken down before the company published its findings on July 22. By that point, the page had been viewed 7,100 times<\/strong>.<\/p>\n\n

When victims clicked the \u201cDownload\u201d button, they were redirected to an external domain , first claude.ai.download-app[.]us<\/strong> and then downloading-api.it[.]com\/html\/claude\/win<\/strong> , where they downloaded a malicious bundle. The bundle contained a renamed but legitimate signed JetBrains<\/a> binary<\/strong> vulnerable to DLL sideloading<\/a><\/strong>, a tampered libcef.dll<\/strong> carrying the actual malware, and an executable named DockerDesktop.exe<\/a><\/strong> that was dropped to disk and registered as a scheduled task for persistent reinfection. The malware itself is SectopRAT<\/strong>, a remote access trojan<\/a> that steals credit card data, personal information, files, and passwords.<\/p>\n\n

Tracing the attacker required significant effort. Huntress researchers had to peel back multiple layers of defense on the payloads, using Claude<\/a> itself to analyze them and uncover the command-and-control address<\/strong>. In the process, they found connections to earlier malware campaigns. WHOIS records and the Validin<\/a> intelligence platform<\/strong> tied the download-app[.]us<\/strong> registration to an email address linked to ten domains dating back to December 2025. One of those domains, polse[.]us<\/strong>, was seized by Microsoft<\/a> as part of Operation Endgame<\/a><\/strong> after being identified as hosting the StealC infostealer<\/strong>.<\/p>\n\n

Huntress also linked the actor to an April 2026 campaign that used Docker Hub<\/strong> to distribute a fake Docker Desktop installer. That campaign employed the same libcef.dll sideloading trick<\/strong> and relied on a trusted domain to disarm suspicion. (This also explains the leftover DockerDesktop.exe<\/strong> filename in this month\u2019s bundle.)<\/p>\n\n

Their advice for users is straightforward: Do not implicitly trust search engine ads or top-level domains when searching for software to download. Threat actors have become highly skilled at pushing malicious ads through popular search engines and finding ways to host malicious content on legitimate platforms and domains.<\/p>\n\n(Source: Help Net Security<\/a>)<\/em>","protected":false},"excerpt":{"rendered":"

A threat actor exploited Anthropic’s Claude Artifacts feature to host a fake download page on the legitimate claude.ai domain, tricking users from a sponsored Bing ad into downloading the SectopRAT remote access trojan, compromising at least 29 organizations over two days in July. The attack used…<\/p>\n","protected":false},"author":1,"featured_media":224429,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_themeisle_gutenberg_block_has_review":false,"cybocfi_hide_featured_image":"","footnotes":""},"categories":[57,3247,3297,3327,3254],"tags":[238057,238056,238058,103875,238055],"entities":[806,2115,1020,4936,58665,79869,238059,38838,2269,904,119521,22569,76428,66366],"class_list":["post-224430","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech-news","category-artificial-intelligence","category-cybersecurity","category-newswire","category-technology","tag-claude-artifacts","tag-claude-download","tag-claude-ai-domain","tag-dll-sideloading","tag-sectoprat","entity-anthropic","entity-bing","entity-claude","entity-claude-artifacts","entity-docker-desktop","entity-docker-hub","entity-dockerdesktop-exe","entity-huntress","entity-jetbrains","entity-microsoft","entity-operation-endgame","entity-sectoprat","entity-stealc","entity-validin"],"_links":{"self":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/224430","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/comments?post=224430"}],"version-history":[{"count":0,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/posts\/224430\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media\/224429"}],"wp:attachment":[{"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/media?parent=224430"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/categories?post=224430"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/tags?post=224430"},{"taxonomy":"entity","embeddable":true,"href":"https:\/\/digitrendz.blog\/z\/wp-json\/wp\/v2\/entities?post=224430"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}