A fake Claude desktop app on claude.ai pushed SectopRAT

The URL bar said claude.ai. The certificate was valid. The download button was right where you'd expect it. And the file that came down was an infostealer that harvested browser passwords, cookies, and card data from employees at 29 companies. A fake Claude desktop app hosted on Anthropic's own domain is the cleanest demonstration yet that "check the domain" is no longer a control.

What actually happened

Huntress documented the campaign, which it calls FakeAgent, after its SOC lit up across 29 organizations on July 21–22, 2026 with the same pattern: an unexpected executable, new Defender exclusions, odd persistence. The entry point was a Bing search for "claude desktop app" and a sponsored result pointing at a Claude Artifact — user-published content that lives on the legitimate claude.ai domain. The artifact rendered a convincing download page and pushed clicks through claude.ai.download-app[.]us to an attacker host serving ClaudeDesktop.exe. Per Help Net Security, the page carried an easy-to-miss "user-generated and unverified" disclaimer; Huntress reported it and Anthropic removed it. It had racked up about 7,100 page views first.

The payload is worth reading carefully because it tells you what you're up against. ClaudeDesktop.exe was a renamed, legitimately signed JetBrains binary (jcef_helper.exe) sideloading a malicious libcef.dll packed with VMProtect. Before executing, it inspected DirectX graphics adapters for QEMU and VMware signatures to avoid sandboxes, then decrypted its payload using GPU shaders with a modified AES routine — moving the crypto off the CPU where most tooling watches. C2 configuration was stored in Ethereum contracts ("EtherHiding") so the operator could rotate infrastructure without touching the malware. The end state was SectopRAT: browser logins, cookies, autofill, credit cards, FTP credentials, messaging clients. Huntress tied the same operator to an April 2026 Docker Desktop campaign using identical sideloading.

Why fake AI installers matter for your business

Your team is installing AI tools every week right now, mostly on their own initiative, mostly from a search result. That is the attack surface. Every heuristic you've taught them — look at the domain, check for HTTPS, avoid sketchy sites — returned green on this one, because the staging page genuinely was on the vendor's domain. Any platform with a publish-an-artifact feature inherits this problem, and that's most of them now.

The fix isn't more awareness training. It's removing search from the install path. Keep one internal page listing the approved AI tools and the exact vendor download URL for each, and make that the only sanctioned route. Never click a sponsored result for a software download — scroll past the ads to the vendor's own docs. On the enforcement side, application allowlisting stops unsigned or unexpected binaries in %APPDATA% and Downloads from running at all, and a new Defender exclusion created by a user should be a page, not a log line. That single signal is what surfaced this campaign.

Sources: Huntress, Help Net Security, BleepingComputer.