How the attack works
A malvertising campaign on Bing is pushing a fake Claude desktop app installer that delivers SectopRAT, a .NET-based remote access trojan. The campaign, tracked by researchers as FakeAgent, has been active since at least April 2026 and has compromised 29 organizations so far, according to Huntress and IT Security Guru reports.
The attacker buys Bing ads for keywords related to “Claude desktop,” “Claude AI,” and “Anthropic desktop app.” When a user searches for the legitimate Claude desktop application, the ad appears at the top of the search results. Clicking it takes the user to a page on the legitimate claude.ai domain that hosts a malicious installer.
The trick is that the malicious content is hosted on the real claude.ai domain itself, not a lookalike. The attackers abuse Anthropic’s Claude Artifacts feature, which lets users create and share interactive content on the platform. They upload a fake installer as an artifact, and the artifact link on claude.ai hosts the payload. The Bing ad points to this claude.ai artifact URL, so even security-savvy users who check the domain see “claude.ai” and let their guard down.
What SectopRAT does
SectopRAT is an information-stealing trojan with a broad feature set. Once installed, it can capture keystrokes, steal browser cookies and saved credentials, exfiltrate files from the desktop and documents folders, take screenshots, and log clipboard contents. It also establishes persistent remote access, letting attackers move laterally through the network.
The malware is written in .NET and uses encrypted communication channels to phone home to its command-and-control servers. Researchers at Huntress noted that the payload is delivered as a ZIP archive that mimics the legitimate Claude installer filename, “Claude-Pro-windows-x64.zip,” to avoid suspicion during the download.
What makes SectopRAT particularly dangerous in this campaign is that it’s delivered through a domain users already trust. A developer searching for “Claude desktop app” who clicks a Bing ad, sees claude.ai in the address bar, and downloads what looks like a legitimate installer is unlikely to question it until it’s too late.
Who is the target
So far, 29 organizations have been confirmed compromised across multiple sectors. The attackers appear to be casting a wide net rather than going after specific companies — anyone searching for the Claude desktop app on Bing is a potential target. The campaign is particularly effective against developers, IT professionals, and AI enthusiasts who are actively seeking AI tools for local use.
The use of malvertising (malicious advertising) as the delivery mechanism means the attackers are paying per click. This is a calculated investment: each compromised machine gives them access to credentials, session tokens, and possibly corporate VPNs or internal tools, making the ROI on a few cents per click very attractive from the attacker’s perspective.
How to protect yourself
The safest way to get the Claude desktop app is to go directly to console.anthropic.com or the official Anthropic GitHub repository. Do not search for “Claude desktop download” and click the first link, even if it looks like it goes to a legitimate domain.
Some practical steps:
Bookmark the official download page rather than searching for it each time. Enable ad blockers that also block search engine ads — uBlock Origin and similar tools can filter out sponsored results on Bing and Google. Check the URL before downloading: claude.ai is legitimate, but a download hosted on claude.ai/artifact/xyz123 is not the official installer. Verify file signatures if available, and scan downloaded installers with antivirus software before running them.
For organizations, block Bing ads and Google ads at the DNS level using a security solution that categorizes search ads as potentially malicious. Segment developer workstations so that a compromised machine can’t easily reach internal systems. Monitor for unusual DNS lookups to known malware C2 domains, and restrict outbound network access from development machines to only the services they actually need.
Broader implications
This campaign highlights a blind spot in supply chain security. The claude.ai domain itself wasn’t compromised — the attackers simply used a legitimate feature (Claude Artifacts) for an illegitimate purpose. This is hard to defend against because the domain reputation is clean, the SSL certificate is valid, and the hosting platform is the developer’s own tool.
Software composition analysis tools and domain reputation checks won’t catch this type of attack because they look for malicious domains, not malicious content on trusted domains. The same pattern applies to any platform that lets users upload or share content on a first-party domain: GitHub Gists, AWS S3 buckets with open uploads, Google Drive shared folders, and Pastebin are all vectors for the same kind of attack.
Platforms like Anthropic and OpenAI that offer artifact or file-sharing features need to implement content scanning for uploaded binaries, applied before the artifact is publicly accessible. Until then, the safest assumption is that any AI tool you find through a search ad — even on a legitimate domain — could be malware.
Not the first AI tool malvertising campaign
This is part of a pattern. In April 2026, Malwarebytes documented a similar campaign where fake Claude sites hosted on third-party domains installed malware that gave attackers full remote access. In May, attackers used Google Ads to promote fake versions of DeepSeek and ChatGPT desktop apps. Each campaign uses the same playbook: buy ads for trending AI tool keywords, host a fake installer on a convincing-looking domain, and profit from the AI gold rush.
The difference with the Bing Ads variant is the use of the legitimate claude.ai domain as the hosting platform. Previous campaigns required registering a lookalike domain like “claudee-desktop.com” or “chatgpt4download.net,” which security tools and attentive users could catch. By hosting on claude.ai itself, the attackers bypass the domain reputation check entirely.
Expect this pattern to spread. Every platform that lets users share files on a first-party subdomain or artifact URL is a potential vector. The fix is the same across platforms: scan uploaded binaries before they go public, and treat hosted artifacts as untrusted content regardless of the domain they live on.