Fake Claude app promoted by Bing ads pushes SectopRAT malware

Summary

A malvertising campaign on Bing search results is distributing the SectopRAT malware by promoting a fake Claude desktop app. The attackers leverage a legitimate Claude.ai domain to host malicious artifacts, which then direct users to download a fake installer. This installer contains a malicious DLL that deploys the SectopRAT remote access trojan, capable of stealing various sensitive data.

Full text

Fake Claude app promoted by Bing ads pushes SectopRAT malware By Bill Toulas July 23, 2026 03:48 PM 0 A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware. At least 29 organizations were compromised between July 21-22 during the malicious operation, which researchers call FakeAgent. The attacker uses a malicious Claude Artifact hosted on Claude’s legitimate domain, which is a common tactic that has been used The attackers used a malicious Claude Artifact hosted on Claude’s legitimate domain, a tactic that has been used at the beginning of the year to push macOS malware via ClickFix lures. Researchers at managed security company Huntress found that the malicious Claude Artifact, downloaded 7,100 times before Anthropic removed it, directed visitors to websites that hosted a fake installer named ClaudeDesktop.exe. Phishing page hosted as a Claude artifactSource: Huntress However, the file is a legitimate JetBrains Chromium component that sideloads a malicious DLL (libcef.dll) to deliver the SectopRAT remote access trojan with info-stealing capabilities. Persistence on the system is achieved through another executable named DockerDesktop.exe, which installs a scheduled task. Huntress says that the various loaders and staging components used in the infection chain feature anti-analysis mechanisms, including VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual machine (VM) detection. The SectopRAT malware was recently observed being distributed via CastleLoader campaigns and ClickFix attacks. The malware uses the EtherHiding technique to retrieve a working command-and-control (C2) address via Ethereum BNB Smart Chain transactions. SectopRAT, also known as ArechClient2, has been active since 2019 and is an information-stealer with HVNC (Hidden Virtual Network Computing) functionality. It allows remote hands-on operations and real-time interaction with the compromised system. The malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products. Malicious Bing search resultsSource: Huntress In an interesting twist, Huntress reports it used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET code analysis. Analysis of the decrypted .NET payload (SectopRAT) helped attribute the attacks to SectopRAT operations, or a closely related fork, and opened the path to infrastructure analysis. At that stage, the researchers found 10 domains registered to the same email address since December 2025, with one of them previously linked to the StealC distribution and seized during Operation Endgame. Huntress does not have enough evidence to attribute the FakeAgent campaign to a specific, known threat cluster. Users looking for software should trust official websites and download portals, instead of search results, especially sponsored ones. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: Claude Fable 5 stays free for paid users until July 19 as Anthropic buys more timeClaude Fable 5 isn’t permanently leaving subscriptions, Anthropic saysClaude Fable relaunch disappoints users with nerfed performanceAnthropic rolls out Sonnet 5 with near-Opus 4.8 performance at a lower priceClean GitHub repo tricks AI coding agents into running malware

Indicators of Compromise

• malware — SectopRAT
• malware — ArechClient2
• domain — claude.ai

Entities