Redbot Labs / Threat Intelligence
Fake Claude Artifact Leads to SectopRAT Compromise Across 29 Organizations
- Incident ID
- RBT-TI-0079
- Organization
- Multiple Organizations / Anthropic Claude
- Reported Location
- Global / Victim Locations Undisclosed
- Severity
- High
- Category
- AI Platform Trust Abuse / Malware Delivery
- Record Date
- 2026-07-22
Incident Summary
Huntress documented a malvertising campaign that compromised at least 29 organizations by abusing Anthropic's public Claude Artifact feature as part of the malware-delivery chain.
Victims searching Bing for the Claude Desktop application encountered sponsored results leading to a malicious public Artifact hosted on the legitimate claude.ai domain.
The Artifact impersonated an official Claude Desktop or Cowork download experience and redirected users to attacker-controlled infrastructure serving a fake ClaudeDesktop.exe installer.
Executing the installer initiated a malware chain ultimately attributed by Huntress to SectopRAT, a remote-access trojan capable of stealing passwords, files, browser information, payment-card data, and other sensitive information.
The malicious Artifact accumulated approximately 7,100 views before Huntress reported it and Anthropic removed it.
What Happened
Victims searched Bing for the Claude Desktop application and were presented with malicious sponsored search results.
One result pointed directly to a public Claude Artifact hosted on Anthropic’s legitimate claude.ai domain.
The Artifact visually impersonated the official Claude Desktop and Cowork download experience, creating a strong trust signal because the initial page used Anthropic’s genuine domain and TLS certificate.
When users clicked the download control, the Artifact redirected them to attacker-controlled infrastructure.
Victims were then served a fake ClaudeDesktop.exe executable.
The installer used DLL sideloading and additional staging behavior to deliver SectopRAT.
Huntress observed the campaign across at least 29 organizations and documented malicious installations, Microsoft Defender exclusions, persistence, and additional execution activity.
The malware used anti-analysis techniques including VMProtect, GPU-based environment checks, and blockchain-hosted command-and-control information.
Huntress reported the malicious Artifact to Anthropic, and it was removed by July 22.
Affected Systems
Claude Artifacts / Windows Endpoints / Claude Desktop Users / Browser Credentials / Files / Payment Information / User Credentials / Remote Access Infrastructure
Attack Vector
Indirect Prompt Injection / Zero-Click Data Exfiltration
Business Impact
Huntress observed confirmed malicious activity across at least 29 organizations.
Compromised endpoints received SectopRAT, providing the attacker with remote-access capability and the ability to collect passwords, browser data, files, payment-card information, and other sensitive user data.
The campaign demonstrates a significant trust-boundary problem for public AI platforms.
Users were not initially directed to an obviously fraudulent domain. Instead, the attacker used a legitimate Claude-hosted Artifact as the first visible stage of the attack, allowing malicious content to inherit trust from Anthropic’s domain and brand.
This can reduce user suspicion and weaken traditional phishing heuristics that rely heavily on identifying lookalike domains or invalid certificates.
The campaign also demonstrates that publicly shareable AI content can become part of the malware-delivery ecosystem even when the underlying AI provider and model have not themselves been compromised.
Redbot Analysis
FakeAgent demonstrates that the AI attack surface includes the trust users place in AI-provider domains and publicly shareable AI content.
The attackers did not compromise Anthropic’s underlying infrastructure or exploit the Claude model.
Instead, they abused a legitimate publishing feature to place malicious content inside a trusted first-party environment.
That distinction is important.
Traditional phishing defense frequently trains users to inspect domain names, certificates, and obvious signs of impersonation. In this campaign, those signals initially appeared legitimate because the first attack stage was genuinely hosted on claude.ai.
The attack therefore shifted the trust decision away from domain legitimacy and toward the content and actions requested by the page.
As AI platforms increasingly support public conversations, Artifacts, generated applications, shared agents, plugins, skills, and other user-created content, those surfaces may become attractive staging points for malware delivery and social engineering.
Organizations should treat publicly shared AI content as untrusted user-generated content regardless of the domain hosting it.
Security controls should also monitor AI-related software downloads, executable launches following browser sessions on shared AI pages, unexpected Defender exclusions, DLL sideloading, and other endpoint behaviors associated with fake AI-tool installation campaigns.
Redbot Labs assesses trusted AI platform abuse as an emerging attack pattern that warrants dedicated security controls as AI providers become increasingly integrated into everyday enterprise workflows.
