A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware.
The attackers used a malicious Claude Artifact hosted on Claude’s legitimate domain, a tactic that has been used at the beginning of the year to push macOS malware via ClickFix lures.
Researchers at managed security company Huntress found that the malicious Claude Artifact, downloaded 7,100 times before Anthropic removed it, directed visitors to websites that hosted a fake installer named ClaudeDesktop.exe.
The SectopRAT malware was recently observed being distributed via CastleLoader campaigns and ClickFix attacks.
Malicious Bing search resultsSource: HuntressIn an interesting twist, Huntress reports it used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET code analysis.
A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain to deliver the SectopRAT malware.
At least 29 organizations were compromised between July 21-22 during the malicious operation, which researchers call FakeAgent.
The attackers used a malicious Claude Artifact hosted on Claude’s legitimate domain, a tactic that has been used at the beginning of the year to push macOS malware via ClickFix lures.
Researchers at managed security company Huntress found that the malicious Claude Artifact, downloaded 7,100 times before Anthropic removed it, directed visitors to websites that hosted a fake installer named ClaudeDesktop.exe.
Phishing page hosted as a Claude artifact
Source: Huntress
However, the file is a legitimate JetBrains Chromium component that sideloads a malicious DLL (libcef.dll) to deliver the SectopRAT remote access trojan with info-stealing capabilities.
Persistence on the system is achieved through another executable named DockerDesktop.exe, which installs a scheduled task.
Huntress says that the various loaders and staging components used in the infection chain feature anti-analysis mechanisms, including VMProtect packing, shader timing checks, GPU and VRAM checks, and virtual machine (VM) detection.
The SectopRAT malware was recently observed being distributed via CastleLoader campaigns and ClickFix attacks.
The malware uses the EtherHiding technique to retrieve a working command-and-control (C2) address via Ethereum BNB Smart Chain transactions.
SectopRAT, also known as ArechClient2, has been active since 2019 and is an information-stealer with HVNC (Hidden Virtual Network Computing) functionality. It allows remote hands-on operations and real-time interaction with the compromised system.
The malware targets user passwords, credit card data, files, browser logins and cookies, FTP credentials, data from various messaging clients, including Discord and Telegram, Steam, and VPN products.
Malicious Bing search results
Source: Huntress
In an interesting twist, Huntress reports it used Claude Opus 4.8 to assist with shader emulation, cryptographic reconstruction, and .NET code analysis.
Analysis of the decrypted .NET payload (SectopRAT) helped attribute the attacks to SectopRAT operations, or a closely related fork, and opened the path to infrastructure analysis.
At that stage, the researchers found 10 domains registered to the same email address since December 2025, with one of them previously linked to the StealC distribution and seized during Operation Endgame.
Huntress does not have enough evidence to attribute the FakeAgent campaign to a specific, known threat cluster.
Users looking for software should trust official websites and download portals, instead of search results, especially sponsored ones.
