A malware campaign tracked by security firm Huntress and dubbed FakeAgent shows how quickly a legitimate AI brand and a trusted domain can be turned into an infection vector. Between July 21 and July 22, 2026, at least 29 organizations experienced unusual software installs and hidden persistence mechanisms after employees simply searched for a desktop version of Anthropic’s Claude assistant.

An Attack That Starts With a Completely Normal Search

The infection chain begins with an everyday Bing search for a Claude desktop app. Sponsored results fill the top of the results page, a pattern seen before in weaponized advertising campaigns targeting tools like PuTTY. Mixed in among those ads is a sponsored link that, critically, actually lands on the legitimate claude.ai domain, specifically a public Artifact page. Public Artifacts are user-generated, shareable pages, and while Claude itself displays a warning that such content is unverified, many users reasonably assume that anything hosted on the official domain is safe.

Clicking the download button on the fraudulent Artifact page routes the victim through a redirect chain to a lookalike domain before ultimately serving a file named ClaudeDesktop.exe from a separate hosting domain. Because the journey began on a genuine Claude.ai address, Huntress notes that many victims ran the installer without a second thought.

Trusted Binaries, Hijacked Purpose

ClaudeDesktop.exe is not the real application. It is a renamed, legitimately signed helper binary, repurposed to load a tampered library placed alongside it, a classic DLL sideloading technique that lets malicious code execute under the shadow of a trusted, signed process. A near-identical copy, disguised as a Docker Desktop binary, is later written to disk and registered as a scheduled task to survive a reboot.

A second stage introduces another signed binary that loads yet another altered library. That stage inspects graphics hardware and available video memory to detect virtual machines and sandboxes, and rather than decrypting its hidden payload through ordinary CPU instructions, it does so using a graphics shader, a deliberate choice that helps the malware slip past analysis tools tuned to watch conventional execution paths. The end result is SectopRAT, a remote access trojan built to harvest browser logins, saved cookies, autofill data, stored credit card numbers, and data from messaging applications.

• Initial lure: a sponsored Bing ad linking to a malicious public Claude Artifact.
• Delivery: a redirect chain ending in a disguised executable served from a lookalike domain.
• Persistence: scheduled tasks and Microsoft Defender exclusions maintain the foothold after reboot.
• Payload: SectopRAT, targeting credentials, financial data, and messaging app contents.

Command Infrastructure Hidden on the Blockchain

Rather than hard-coding command-and-control addresses in plain text, the operators pull server details from Ethereum smart contracts, a technique known as EtherHiding. Because updating a blockchain transaction is trivial and the resulting infrastructure is difficult to take down through conventional means, the approach gives attackers a resilient way to rotate infrastructure without needing to re-distribute malware.

7,100 Views Before Takedown

Before Anthropic removed the offending Artifact, Huntress reports it had already accumulated roughly 7,100 page views, a figure that illustrates how efficiently a combination of paid search placement and a trusted domain can funnel traffic toward malicious infrastructure. Huntress also linked the operator’s style to earlier campaigns using fake Docker Desktop lures, suggesting this is a repeated playbook rather than a one-time experiment.

What Organizations Should Do

Huntress’ guidance is straightforward: employees should be encouraged to type official vendor addresses directly rather than trusting sponsored search results, even when those results appear to point to a real, familiar domain. Security teams should watch specifically for unexpected ClaudeDesktop.exe or DockerDesktop.exe activity, unfamiliar EdgeUpdate folder paths, and newly created scheduled tasks that don’t correspond to approved software. Basic remote access trojan hygiene still applies broadly: keep software patched, limit unnecessary administrative privileges, and verify every installer against the vendor’s own official site rather than a search result, however convincing it looks.

Huntress reported the malicious Artifact to Anthropic, which has since removed it. The broader takeaway extends past this single incident: as AI tools become part of everyday corporate workflows, both paid search advertising and AI platform hosting features are becoming attractive staging grounds for malware convincingly dressed up as legitimate software.