Fake Claude Download Page Led to SectopRAT

What happened

Employees searching for the Claude desktop app clicked a sponsored Bing ad that pointed to the genuine claude.ai domain. Instead of landing on an official Anthropic page, they arrived at a public Artifact, a feature that lets Claude users publish content to a shareable link without requiring a Claude account. The Artifact was designed to look like a real Claude download page. Clicking the "Download" button redirected victims first to claude.ai.download-app[.]us and then to downloading-api.it[.]com/html/claude/win, where a malware bundle was served. The payload was SectopRAT, a remote access trojan that grabs and exfiltrates credit card data, personal information, files, and passwords. Huntress reported that employees at at least 29 organizations were compromised over two days in July, and that the Artifact had been viewed 7,100 times before it was taken down.

Why it succeeded

The attack relied on a chain of trust signals that all pointed the wrong way. The ad itself pointed to the genuine claude.ai domain, which gave the initial click a strong sense of legitimacy. Because Claude Artifacts can be published publicly and viewed by anyone without an account, attackers were able to host convincing, professional-looking content directly on infrastructure that users already trust. The only visible warning sign was a short line of text stating that the content was user-generated and unverified, a disclaimer that is easy to miss on an otherwise polished page.

What to watch for

• Sponsored search results being used to advertise software downloads
• A "Download" button that redirects away from the domain you started on
• Small disclaimers noting that a page's content is user-generated or unverified
• Installer bundles arriving from unfamiliar external domains rather than a vendor's own infrastructure

Building resistance

This case shows that a familiar domain in a search ad is not proof of safety. Even legitimate platforms can be used to host attacker-controlled content when they allow public, unauthenticated publishing. Employees, IT staff, developers, and anyone who downloads software as part of their role should be encouraged to avoid sponsored ad results for software downloads and instead navigate directly to vendor sites they type in themselves or have bookmarked. Teams should also build habits around scrutinizing redirects during any download flow: if a download button sends the browser to a different, unfamiliar domain, that is a reason to stop and verify before proceeding. Reinforcing awareness of small trust-and-safety disclaimers, like notices that content is user-generated and unverified, can also help employees recognize when a page that looks official may not be.

How did attackers use claude.ai to spread malware?

Attackers published a public Artifact on claude.ai that looked like a legitimate Claude desktop app download page, then promoted it through a sponsored Bing ad. Clicking download redirected victims to attacker-controlled domains that served the SectopRAT malware.

What is SectopRAT?

SectopRAT is a remote access trojan described as grabbing and exfiltrating user credit card data, personal information, files, and passwords.

How many organizations were affected by this attack?

According to Huntress, employees at at least 29 organizations were compromised over two days in July after clicking the sponsored ad.

How can I tell if a software download page is fake?

Watch for sponsored ad results used for software downloads, download buttons that redirect to unfamiliar domains, and small disclaimers noting that content is user-generated and unverified.