A malicious advertising campaign on Bing is promoting a counterfeit Claude desktop application hosted on the legitimate Claude.ai domain. The fake installer delivers the SectopRAT remote‑access trojan, compromising at least 29 organizations between July 21‑22.

Key Takeaways

  • Bing ads were used to push a fake Claude installer.
  • The installer sideloads a malicious DLL (libcef.dll) that delivers the SectopRAT trojan.
  • At least 29 organizations were compromised; attackers employed advanced anti‑analysis techniques.

A new malvertising operation, dubbed “FakeAgent” by Huntress, is leveraging paid Bing search ads to promote a counterfeit Claude desktop app. Although the download is hosted on the legitimate Claude.ai domain, the file named ClaudeDesktop.exe is actually a JetBrains Chromium component that loads a malicious libcef.dll. This DLL installs the SectopRAT remote‑access trojan, which harvests passwords, credit‑card data, files, and credentials from messaging clients such as Discord and Telegram.

Technical Breakdown

Before Anthropic removed it, the fake artifact was downloaded more than 7,100 times, directing victims to a phishing page that launched a second loader called DockerDesktop.exe. This executable creates a scheduled task to maintain persistence. Huntress observed a suite of anti‑analysis mechanisms—including VMProtect packing, shader‑timing checks, GPU/VRAM validation, and virtual‑machine detection—embedded throughout the infection chain.

Why This Matters

BozokMedia analysis shows that the blending of AI‑branded services with sophisticated malvertising raises the bar for threat detection. When trusted brand names like Claude are weaponized, even seasoned security teams can miss the malicious payload buried in legitimate‑looking domains.

"SectopRAT's blockchain‑based C2 makes it notoriously hard to detect with traditional network‑security tools."

SectopRAT, also known as ArechClient2, has been active since 2019 and uses the EtherHiding technique to retrieve command‑and‑control addresses via Ethereum and BNB Smart‑Chain transactions. Its HVNC (Hidden Virtual Network Computing) capability enables real‑time interaction with compromised systems, allowing attackers to exfiltrate user passwords, credit‑card numbers, browser cookies, FTP credentials, and data from a range of applications.

Researchers noted that the same team employed Claude Opus 4.8 for shader emulation, cryptographic reconstruction, and .NET code analysis, highlighting how threat actors repurpose legitimate AI tools for malicious purposes. Ten domains registered to a single email address since December 2025 were linked to the campaign, one of which had previously been seized during Operation Endgame.

Did You Know?: SectopRAT first appeared in 2019, but its resurgence in 2024‑2025 came after adopting blockchain‑based C2, making attribution even tougher.

Frequently Asked Questions

Q1: How can users verify the authenticity of Claude software downloads?
A: Always download directly from the official anthropic.com or Claude.ai homepage and avoid sponsored search results.

Q2: What steps should an organization take if a system is suspected of being infected with SectopRAT?
A: Isolate the affected network segment, remove any scheduled tasks, and run a full scan with a reputable anti‑malware solution.