A researcher found fake Claude “download” pages hosted on claude.ai and promoted via paid Google Ads. The pages tricked users into clicking “download” and running an install command that actually installed an information-stealing malware, leveraging the trust of a legitimate domain and legitimate-looking ads.
A researcher identified fake Claude download pages hosted directly on claude.ai, made possible through the platform's user-generated artifacts feature. Attackers promoted these fake pages using paid Google Ads, giving the lure two layers of legitimacy: a trusted domain and a well-placed advertisement. When a user searched for a Claude desktop download, the ad and page appeared as a normal, credible result.
Once a user clicked the download button, they were prompted to run an install command on their computer. Rather than installing the Claude application, this command installed an infostealer, a type of malware designed to harvest credentials and other sensitive data from the victim's device.
This attack worked because it exploited trust in two places at once. The domain, claude.ai, is legitimate, and the ad appeared through Google's own advertising platform, both of which most users treat as reliable indicators of safety. Attackers did not need to build a convincing fake domain; they abused a legitimate platform's user-generated content capability to host the lure instead.
The attack also relied on a common but risky behavior: running an install command copied from a webpage. Many users are accustomed to following setup instructions from download pages without pausing to verify the source or the command's contents.
These red flags apply broadly across teams that download and install AI tools, including developers, engineering staff, and general employees.
Organizations and individuals can reduce risk from this type of attack by adopting a few consistent habits:
This attack targeted a broad range of roles, including all employees, IT helpdesk staff, and developers and engineering teams, reflecting how widely AI tool downloads are used across an organization. Because the lure combined a trusted domain with a paid ad, technical filtering alone was insufficient; awareness of these red flags is a necessary complement to technical controls.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
The fake page was hosted directly on claude.ai using user-generated artifacts and was promoted through paid Google Ads, so both the domain and the ad appeared legitimate.
Clicking download led users to run an install command that actually installed an information-stealing malware rather than the Claude application.
It relied on abusing ad placement and a trusted domain's user-generated content feature rather than novel technical exploitation, but it still succeeded by exploiting user trust in familiar platforms.
Employees should navigate to software downloads through known official paths, such as bookmarks or vendor pages typed directly, rather than clicking ad results, and avoid running install commands from websites unless verified by IT.
You Google “Claude desktop download,” click the top Google Ad, and land on what looks like a real claude.ai page. Here’s the trick: researchers found fake Claude download pages hosted right on claude.ai using user-generated artifacts, pushed with paid Google Ads. The big “Download” button gives you a terminal command that actually installs an infostealer. The domain looks legit, the ad looks legit, that’s the point. The red flag is the flow: you came from an ad, landed on an artifact page, and it’s asking you to copy-paste an install command from the web into your machine. One rule: if a download page tells you to run an install command, stop and contact IT before you paste anything into Terminal or Command Prompt.
The article highlights real, ongoing campaigns where attackers trick people into installing malware via fake software-download websites and a disguised browser extension. These lures are used to steal credentials, browser cookies, and authenticated sessions, letting attackers take over accounts…
Attackers are exploiting GTA 6 hype by creating convincing fake Rockstar-branded “demo” websites that appear in Google search results. The sites use “Play Now”/“Official Download” lures to trick people into downloading a small Windows executable that installs Vidar infostealer and steals saved…
Bitdefender reports that Google Play’s “Early Access” apps can’t be publicly rated or reviewed, reducing a key warning signal employees use to spot deceptive apps. The research found thousands of suspicious Early Access apps (including fake casino/reward apps and utilities) promoted on social…
This bulletin describes multiple real-world social engineering campaigns where attackers impersonate IT support or use trusted-looking sharing and “Allow” prompts to gain access. Several campaigns abuse Microsoft Teams and document-sharing lures to trick employees into installing remote tools or…
This roundup describes real-world social engineering where attackers impersonate recruiters on LinkedIn and lure developers into running “coding tests” that install malware. It also outlines active phishing campaigns that abuse trusted cloud services (Google, AWS, Azure, Cloudflare) to send…
Kaspersky reported that Iran-linked APT Mirage Kitten approached software engineers on LinkedIn using fake recruiter personas and sent “coding challenges” that were actually trojanized projects. The lure used legitimate-looking cloud hosting (Amazon S3) and even instructed victims not to use AI…
