Fake Claude Installers Delivered SectopRAT to 29 Organizations

Attackers used a public page on claude.ai to steer victims toward a fake Claude Desktop installer, according to a July 22 investigation from Huntress. Its security operations center found related infections at 29 organizations over two days. The installer ultimately delivered SectopRAT, a remote access trojan built to steal credentials and other data.

The campaign, which Huntress named FakeAgent, began with sponsored results for searches such as “Claude Desktop App.” One ad opened a public Claude Artifact that imitated an official download page. The artifact was user-generated, but its address sat on Anthropic’s legitimate domain. A download button then redirected the visitor through attacker-controlled sites to ClaudeDesktop.exe.

The abuse did not require a breach of Anthropic’s systems. It relied on a distinction that is easy to miss during a routine software search: a provider can host both its own product pages and content published by its users. The domain looked right even though the author and destination were wrong.

The handoff from Claude to malware

Huntress said the malicious artifact collected about 7,100 views before Anthropic removed it. The page carried a notice that its content was user-generated and unverified, but it otherwise resembled a place where someone might reasonably expect to find an AI tool.

Clicking its download button led to claude.ai.download-app[.]us, followed by another staging address. The resulting file was named ClaudeDesktop.exe, but Huntress identified the executable as a legitimate JetBrains Chromium component. The attackers placed a modified libcef.dll beside it so the signed application would load their code through DLL sideloading.

The chain accumulated credibility at each handoff. Paid placement put the lure near the top of the results, the Claude domain lowered suspicion, and the expected filename arrived inside signed software. Even together, those signals did not establish that Anthropic had published the installer.

Defenders need to analyze the complete handoff. Reputation checks aimed only at the first domain will miss what the browser does next. Endpoint tools that treat a signed process as sufficient evidence of legitimacy will miss the neighboring DLL. Software policy that begins after execution leaves the riskiest decision with the person clicking the ad.

Signed files complicated the trail

The operators added several techniques that slowed analysis. Huntress found VMProtect packing, graphics-hardware checks intended to spot virtual machines, and a shader timing test. A later component used a DirectX shader in its decryption routine, placing part of the work outside the CPU paths commonly inspected by reverse-engineering tools.

The malware also read command-and-control data from transactions associated with BNB Smart Chain contracts. This technique, often called EtherHiding, lets an operator update infrastructure without depending on a conventional domain that defenders can readily block or seize.

Persistence used a second copy of the legitimate Chromium component named DockerDesktop.exe, which ran from a scheduled task. Huntress also found an IBM SPSS binary named sslconf.exe loading another malicious DLL, tempdir.dll. The repeated use of signed applications provided cover for code stored beside them.

Huntress analysts used Claude Opus 4.8 to help emulate the shader and reconstruct parts of the encryption and .NET code. Their account also documents the limits of that assistance. A manually transcribed byte was wrong, and the resulting decryption attempts failed until a person found the error. The researchers disclosed both the model’s contribution and the mistake.

Once decrypted, the .NET payload contained references to browser logins, cookies, payment data, files and passwords. Huntress attributed it to SectopRAT after examining its behavior and command-and-control services.

Public artifacts need their own trust policy

Many companies allow AI provider domains because employees use them for ordinary work. That allowance often treats every path on the domain alike. Public artifacts make that assumption unsafe. They are publishing surfaces, closer to shared documents or user pages than to an official software catalog.

Browser and web-filtering policy should preserve that distinction. A public artifact does not need to be blocked outright, but a request to download an executable from one deserves more scrutiny than a visit to vendor documentation. Redirects from an artifact to a newly registered or unrelated domain should receive the same treatment as redirects from any other user-controlled page.

Software acquisition is the second gap. If employees must search the web for approved AI clients, sponsored results become an informal distribution channel. A managed catalog or a clearly documented vendor path gives users a faster way to obtain the right installer and gives security teams a reliable provenance check.

Endpoint detections can cover the behavior that follows. Useful signals from this campaign include a new download creating Defender exclusions, persistence through a scheduled task, and a signed executable loading a DLL from a user-writable directory. Those events become stronger when correlated with the browser path that produced the file.

Response should include stolen sessions

SectopRAT has information-stealing and remote-access capability, so recovery should extend beyond reimaging the affected computer. Huntress found strings associated with browser credentials, cookies, credit cards, files, FTP clients, Discord and other messaging applications. Incident responders should identify which accounts and sessions were available on the host, revoke affected tokens, rotate exposed credentials and review subsequent cloud activity.

FakeAgent exploited an ordinary habit: checking the domain before trusting a page. That habit still filters out plenty of fraud, but public content on legitimate platforms has weakened it. For software downloads, defenders need to know who published the page and where the button leads. A reputable hostname alone no longer answers either question.