Fake Claude App Delivers SectopRAT Through Bing Ads: What Enterprises Need to Know

Fake Claude App Campaign Abused Claude Artifacts to Deliver SectopRAT

A fake Claude app promoted through Bing sponsored advertisements delivered the SectopRAT remote access trojan to at least 29 organizations.

Unlike traditional fake-download campaigns, attackers first directed victims to a public Claude Artifact hosted on the official claude.ai domain. The page then redirected users through attacker-controlled infrastructure, which ultimately delivered the malicious ClaudeDesktop.exe installer.

Claude Artifacts are shareable content created in Anthropic’s Claude platform, including documents, code, diagrams, or interactive web apps. Here, attackers repurposed one to make the download look legitimate, so victims saw fewer of the warning signs typical of a fake software site.

Huntress tracks this operation as FakeAgent. Rather than relying on fake or typosquatted domains, the attackers paired trusted cloud services with convincing social engineering, making the campaign appear more credible to potential victims.

For enterprise security teams, the incident points to a growing distribution risk as AI adoption accelerates. Employees searching for popular AI tools may unknowingly install malware built to harvest credentials, browser sessions, VPN data, and other sensitive information. Verifying software sources and tightening application governance before rolling out new AI tools is now a baseline control, not a nice-to-have.

What Is the Fake Claude App Campaign (FakeAgent)?

FakeAgent is Huntress’s name for a malware campaign distributing SectopRAT through fake AI application downloads. What sets it apart is the use of a public Claude Artifact hosted on the official claude.ai domain as a stepping stone in the delivery chain.

Rather than sending victims straight to attacker-owned infrastructure, the operators first routed them through legitimate Claude-hosted content, then redirected to the fake installer. That sequence reads as far more trustworthy than a conventional scam page.

The campaign layered several techniques to complicate detection and response:

• Bing malvertising
• DLL sideloading
• Windows Scheduled Task persistence
• EtherHiding for blockchain-based command-and-control (C2) retrieval

Together, these techniques increased the operation’s credibility while complicating detection and malware analysis.

How the Fake Claude App Delivered SectopRAT

The infection chain was staged to build trust before the payload ever landed. Bing malvertising and the claude.ai-hosted Artifact did the work of establishing legitimacy; the installer did the rest.

Here’s how the attack reportedly unfolded:

1. A user searched Bing for the Claude Desktop application.
2. A sponsored ad pointed them to a public Claude Artifact hosted on the official claude.ai domain.
3. The Artifact displayed what looked like an official Claude Desktop download page.
4. Clicking “download” redirected the user to attacker-controlled infrastructure hosting ClaudeDesktop.exe.
5. Running that file kicked off the chain that ultimately deployed SectopRAT.

Instead of relying solely on a fake external website, FakeAgent abused a public Claude Artifact hosted on the legitimate claude.ai domain to make the download appear more trustworthy. It’s a preview of how attackers are likely to keep pairing legitimate services with sophisticated delivery techniques going forward.

How DLL Sideloading Abused a Legitimate JetBrains Component

FakeAgent delivered SectopRAT through DLL sideloading, a technique that exploits how Windows searches for DLL files, letting a malicious library load through an otherwise trustworthy application. No standalone malware loader required; just a legitimate executable doing something it wasn’t supposed to.

Meanwhile, researchers found that ClaudeDesktop.exe was, in fact, a genuine JetBrains Chromium Embedded Framework (CEF) component. The attackers simply dropped a malicious libcef.dll into the same directory. When the executable launched, Windows loaded the attacker’s DLL instead of the real one, executing SectopRAT in the process.

Because the executable itself was legitimate, the malware blended easily into normal endpoint activity, meaning executable reputation checks alone won’t catch this. Security teams need to watch for unexpected DLL loading behavior alongside newly installed applications.

Scheduled Tasks and EtherHiding Helped the Malware Stay Hidden

Persistence and evasion were baked into the campaign from the start, which kept the malware active while making incident response harder.

According to Huntress, a malicious executable named DockerDesktop.exe created a Windows Scheduled Task to survive reboots, a classic technique that lets attackers maintain access without further user interaction.

Researchers also documented several anti-analysis techniques:

• VMProtect packing to complicate reverse engineering
• GPU and VRAM checks to detect virtualized environments
• Shader timing checks to spot sandbox execution
• Virtual machine detection to dodge automated analysis
• A custom DirectX shader that decrypted the malware payload on the GPU before execution

On top of that, the campaign used EtherHiding, pulling C2 information from blockchain transactions instead of hardcoded infrastructure. That lets attackers update C2 locations on the fly, and it makes traditional infrastructure takedowns far less effective.

Defenders responding to similar campaigns should look at persistence mechanisms just as closely as the initial infection vector.

What Makes SectopRAT Dangerous?

SectopRAT is a .NET-based remote access trojan that combines remote control with information-stealing capabilities, giving attackers a way to steal data while keeping a foothold on the infected machine.

Public reporting indicates SectopRAT can target:

• Browser credentials, cookies, and saved sessions
• Credit card information stored in browsers
• Local files and documents
• VPN, FTP, messaging app, and Steam data

Researchers have also observed Hidden Virtual Network Computing (HVNC) functionality, which lets attackers open a hidden remote desktop session, meaning they can act on the machine without anything showing up on the victim’s screen.

As of publication, Huntress had not attributed FakeAgent to a known threat actor, and public reporting hasn’t confirmed credential theft, lateral movement, or data exfiltration in every affected organization. These are SectopRAT’s known capabilities, not a confirmed inventory of what happened in each case.

How to Defend Against Fake Claude App Malware

Because FakeAgent leaned on trusted services rather than fake websites, technical controls matter here just as much as user awareness. A few priorities:

• Download AI applications only from verified vendor sources. Skip sponsored search ads and unofficial download portals.
• Control software installation. Restrict users to approved applications and audit installed software on managed devices regularly.
• Watch for DLL sideloading and persistence behavior. Flag unexpected DLL loads and newly created Scheduled Tasks.
• Strengthen identity security. Require MFA to limit the damage from compromised browser sessions or stolen credentials.
• Train employees on software provenance. Teach users to verify where a download actually comes from before installing.

No single control stops every attack. Software governance, endpoint monitoring, and identity protection working together are what actually blunt campaigns like this one.

How Hexnode Can Help Reduce the Risk of Fake AI Malware

FakeAgent succeeded by getting users to install a fake application, then locking in persistence via DLL sideloading and scheduled tasks. Cutting the impact of the next campaign like it takes both application governance and endpoint investigation.

Hexnode UEM

The infection started with a download from outside approved enterprise channels. Hexnode UEM helps close that gap by:

• Managing, distributing, and deploying enterprise applications on managed devices
• Restricting unauthorized software installs through policy controls
• Enforcing device compliance policies fleet-wide
• Applying Windows security policies to reinforce application governance

Hexnode XDR

If a device is suspected of compromise, Hexnode XDR supports incident response on managed Windows endpoints by helping teams:

• Investigate suspicious process activity and endpoint telemetry
• Search endpoint data using Advanced Investigation Queries
• Examine evidence of persistence, including suspicious scheduled tasks
• Isolate affected devices during an investigation
• Terminate malicious processes to support containment

FakeAgent relied on DLL sideloading and scheduled-task persistence to stay embedded. Endpoint investigation is what tells you whether the damage stopped at the installer or spread further, and which devices need remediation.

Featured resource

Why XDR Is Stronger With UEM

Learn why combining UEM and XDR delivers better endpoint visibility, accelerates incident response, and strengthens enterprise security operations.

Download the Whitepaper

Conclusion

The fake Claude app campaign shows how attackers are increasingly willing to borrow trust from legitimate AI services instead of building fake ones from scratch. Bing malvertising, a public Claude Artifact hosted on the legitimate claude.ai domain, DLL sideloading, and layered evasion techniques combined into an infection chain that appeared legitimate at every step.

The broader lesson for enterprises: as AI tool adoption grows, software sourcing deserves the same scrutiny as any other security control. Managing approved applications, watching for anomalous endpoint behavior, and enforcing device compliance are what stand between this kind of campaign and a real breach.

Software provenance now matters as much as malware detection. Organizations that verify where their software comes from, and keep an eye on what it does after installation, will be better positioned against the next AI-themed social engineering campaign.