Fake Claude app promoted by Bing ads pushes SectopRAT malware

A cyber campaign known as FakeAgent is targeting corporate users by promoting a fraudulent Claude desktop application through Bing advertisements. According to reports from BleepingComputer and TechRound, these ads lead victims to a fake download page that distributes SectopRAT, a type of data-stealing malware. The attack is sophisticated in its delivery, as Help Net Security reports that attackers managed to host the fake download page directly on the claude.ai domain. This deceptive infrastructure is designed to trick users into believing they are downloading official software from the legitimate service provider. Coverage from IT Security Guru and TechRound emphasizes the scale of the impact, noting that the campaign has already hit 29 different organizations.

These outlets highlight that the primary goal of the operation is the distribution of the SectopRAT malware to corporate environments. TechRadar further specifies that hackers achieved this by hiding the dangerous malware on a page that was concealed within the Anthropic-owned claude.ai domain. This specific detail underscores a critical vulnerability or exploitation method used to bypass user suspicion by utilizing a trusted domain to deliver the payload. Context provided by CyberSecurityNews indicates that the FakeAgent campaign specifically utilizes Claude.ai artifacts to infect its targets. The intersection of search engine advertising and the exploitation of a high-profile AI domain makes this a particularly potent threat.

Because corporate users often trust established AI tools, the use of Bing ads to drive traffic to a fake app on a legitimate-looking domain increases the likelihood of successful infection. The use of a Remote Access Trojan (RAT), specifically SectopRAT, indicates a goal of persistent access and data theft from the affected corporate entities. Future monitoring will focus on how the 29 impacted organizations respond to the breach and whether further instances of the fake download page are discovered on the claude.ai domain. Based on the reporting from Help Net Security and BleepingComputer, the primary point of interest is the mechanism that allowed the fake page to exist on the official domain. Observers will be looking for updates on whether more organizations are identified as victims of the FakeAgent campaign and if the malicious Bing ads have been fully removed from the search engine's ecosystem.