In late July 2026, anyone searching Bing for the Claude Desktop app could have clicked a paid ad that displayed Anthropic's genuine domain—claude.ai—and landed on a page that looked like the official download portal. Instead of a productivity tool, they got SectopRAT, an information-stealing remote access trojan that harvested credentials, cookies, and files from at least 29 organizations.

What Happened: A Malware Delivery Chain Disguised as a Trusted Site

Security researchers at Huntress first documented the campaign, dubbed FakeAgent, on July 22. The trap began with a sponsored Bing ad for \"Claude Desktop app,\" which pointed directly to claude.ai. But the destination wasn't Anthropic's download page; it was a public \"Artifact\"—a user-generated, shareable web page created through Claude's own platform. The artifact perfectly mimicked the official Claude Desktop download experience, complete with a \"Download\" button.

The only warning was a discreet line in the corner: \"Content is user-generated and unverified.\" For users trained to check the address bar, claude.ai looked legitimate. The artifact accumulated 7,100 views before Anthropic removed it.

Clicking the download button didn't trigger a download from Anthropic. Instead, it redirected users through a deceptive domain: claude.ai.download-app[.]us, then to downloading-api.it[.]com/html/claude/win. The actual registrable domain was download-app.us, registered on May 9, 2026. The \"claude.ai\" prefix was merely a subdomain—a parsing trick that made the URL appear trustworthy.

The downloaded file, named ClaudeDesktop.exe, wasn't Claude software at all. It was a legitimate, signed component from JetBrains associated with Chromium Embedded Framework. Attackers exploited a DLL sideloading vulnerability: placing a malicious libcef.dll alongside the executable caused it to load attacker code, sidestepping signature checks.

That payload was SectopRAT (also known as ArechClient2), a credential thief active since 2019. It targets browser passwords, cookies, autofill data, payment cards, files, FTP credentials, and sessions from Discord, Telegram, Steam, and VPNs. Huntress noted the malware also includes Hidden VNC capabilities for remote desktop access.

Persistence was achieved via a scheduled task running another file, DockerDesktop.exe, which was identical to the initial loader. A separate component, sslconf.exe, was planted in a path mimicking Microsoft Edge updates. The malware further evaded analysis by checking GPU hardware and video memory to detect virtual machines—common sandbox environments. If the system had low VRAM, it would stay dormant. Command-and-control traffic was concealed using the Ethereum BNB Smart Chain, a technique known as EtherHiding, making takedowns harder.

Why the Domain Trick Worked (and What It Means for You)

FakeAgent upends the common security advice: \"Check the URL before you click.\" The URL was correct. The problem is that trusted domains can host untrusted content. Claude Artifacts, like Google Docs or GitHub Pages, allow anyone to publish web content under the platform's domain. This feature is invaluable for collaboration, but it fundamentally breaks the mental model that a trusted domain guarantees safety.

For everyday Windows users, the takeaway is sobering: you can't rely on the address bar alone. A sponsored search result is paid placement, not an endorsement. Attackers buy ads to appear above organic results, and Bing's ad platform doesn't verify that the landing page is the official download channel—only that it matches the advertiser's chosen destination.

For IT administrators, FakeAgent shows why employees shouldn't be left to find business software through search engines. The official Claude Desktop installer is available at Anthropic's download page, but if a worker googles \"Claude download,\" they might hit a malvertising trap. The safest path is to distribute approved applications silently through management tools like Microsoft Intune or Configuration Manager, or at least provide a company-curated app portal.

Desktop AI assistants are surging in popularity, and threat actors have noticed. In May 2026, another campaign pushed a fake Claude website via Google ads, dropping a Windows backdoor. Huntress also linked FakeAgent to an April 2026 malvertising operation that used a fake Docker Desktop installer on Docker Hub—hence the reused filename DockerDesktop.exe.

The misuse of platform features isn't new. Criminals have long abused cloud storage, document sharing, and website builders to host phishing pages. What's different now is the speed and polish with which an attacker can generate a convincing clone using AI-powered tools. The artifact feature allows rapid creation of interactive pages that mirror official designs, often with minimal effort.

The security community has been warning about the limitations of \"domain-based trust\" for years. The rise of user-generated content platforms, subdomain takeovers, and open redirects means the domain name is just one factor among many. Microsoft itself has been pushing toward a Zero Trust model that verifies every access request, regardless of origin.

What to Do Right Now: A Practical Defense Plan

Defending against campaigns like FakeAgent requires a layered approach. No single check will catch every threat, but combining several practices significantly reduces risk.

For individuals and home users

  • Never download software from a search ad. Bookmark the official download page (e.g., anthropic.com/download) and use it every time. If you must search, scroll past sponsored results.
  • Inspect the final URL that serves the installer. If a page looks like claude.ai but the download comes from an unfamiliar domain, abort.
  • Don't grant administrator rights to unfamiliar installers. If an app demands elevation and you weren't expecting it, stop.
  • Enable multi-factor authentication (MFA) everywhere. Stolen passwords are less dangerous when a second factor is required.
  • Avoid saving passwords in the browser if you can use a dedicated password manager that supports MFA. SectopRAT specifically targets browser credential stores.
  • Keep Windows Defender and real-time protection on. Malware often tries to disable AV; if you get a prompt to exclude a folder \"so the installer works,\" refuse.

For IT administrators and organizations

  • Control software distribution. Use Microsoft Intune, Configuration Manager, or a third-party app management suite to push and update approved applications. Users shouldn't be hunting for installers.
  • Implement application control. Windows includes Smart App Control for consumer devices and App Control for Business (formerly WDAC) for enterprise. These can restrict which binaries run, but be cautious: signed clean loaders can still sideload bad DLLs. Audit mode helps you build rules before enforcement.
  • Apply web filtering to block known malicious domains and newly registered domains, especially those with suspicious subdomain patterns. claude.ai.download-app.us is a red flag.
  • Monitor endpoints for:
  • Unsigned DLLs loaded by signed processes from user-writable directories.
  • Scheduled tasks created from temporary or user profile paths.
  • Unexpected network connections from non-browser processes.
  • Microsoft Defender exclusions created by processes that aren't IT-sanctioned.
  • Require phishing-resistant MFA for privileged accounts—hardware security keys or Windows Hello for Business.
  • Educate users about the limits of URL checking. Use real examples like this one.

If you clicked the ad and ran the installer

Assume breach. The steps:

  1. Isolate the device from the network immediately to cut off C2 communication and lateral movement.
  2. Preserve forensic evidence: take a disk image or at least collect endpoint logs, process trees, and scheduled task details before remediation.
  3. Hunt for persistence: look for tasks named after legitimate software (DockerDesktop) and files in odd locations like %LOCALAPPDATA%\\Microsoft\\EdgeUpdate.
  4. Reset all credentials stored on that device—from a clean machine—starting with email, cloud admin, VPN, and financial accounts.
  5. Invalidate web sessions: many services allow you to sign out everywhere. Stolen cookies can bypass passwords.
  6. Review browser extensions and synced data for unauthorized changes.
  7. If in doubt, reimage the machine. A modern infostealer can burrow deep.

Outlook: Trust Will Require More Than a Domain Name

FakeAgent is unlikely to be the last campaign to exploit a legitimate platform's public sharing features. As AI companies add more collaborative tools, they inadvertently expand the attack surface. The same feature that lets a team prototype a dashboard can be weaponized to forge a download page in moments.

Search engines face pressure to better vet ads that point to pages with download prompts, especially when the domain is a high-value target like claude.ai. But ultimately, the responsibility shifts to software distribution practices. Individuals must become more skeptical of search results offering software, and enterprises must take control of the endpoint.

The FBI's 2024 Internet Crime Report (the most recent available) showed business email compromise and phishing still lead losses, but malvertising and counterfeit software are rising. As AI assistants become essential productivity tools, expect more attackers to target the download step.

The lesson from FakeAgent is clear: a correct domain is not a clean bill of health. When you're about to install something, trust nothing but the source you've verified yourself—not an ad, not a search result, and certainly not a pretty page that happens to sit on a name you know.