FakeAgent Campaign Uses Malicious Bing Ads and Claude.ai Artifacts to Infect Corporate Users

A dangerous new malware campaign is tricking corporate workers who simply want a desktop version of a popular AI assistant.

Between July 21 and July 22, 2026, at least 29 organizations saw unusual software installs and hidden persistence on their systems after staff searched for the Claude desktop app.

The attack begins with paid ads on Microsoft Bing. When someone types a normal query for the app, sponsored results appear that look trustworthy. One of those ads even points to the real Claude.ai website, which lowers suspicion and makes the trap harder to spot.

Analysts from Huntress identified the activity after their security operations center flagged waves of odd executable installs, Defender exclusions, and strange scheduled tasks tied to a file named ClaudeDesktop.exe.

Huntress said in a report shared with Cyber Security News (CSN) that the campaign, which they call FakeAgent, funnels victims through a malicious public Claude Artifact and ultimately delivers SectopRAT, a remote access trojan that steals credit cards, passwords, browser data, and personal files.

Before Anthropic removed the bad Artifact, it had already drawn about 7,100 page views. That volume shows how quickly paid search ads and trusted domains can combine to reach busy office users who only meant to install helpful software.

The campaign also used heavy anti-analysis tricks, including packing and graphics hardware checks that try to spot virtual machines. Those steps slow down defenders and let the malware stay quiet longer on real corporate machines.

FakeAgent Campaign Uses Malicious Bing Ads

The infection chain starts with a simple Bing search for “CLAUDE DESKTOP APP.” Sponsored results fill the top of the page with lookalike download sites, a pattern also seen in earlier weaponized PuTTY Bing ads that abused the same search ads model.

Mixed among them sits a sponsored link that lands on the legitimate Claude.ai domain, specifically a public Artifact page.

Public Artifacts are user-generated pages that anyone can share. Claude itself warns that the content is unverified, yet many people still trust anything hosted on the official domain.

Clicking Download on the fake page sends the user first to claude.ai.download-app.us and then to downloading-api.it.com, where ClaudeDesktop.exe is offered.

Figure 1 in the Huntress material shows the Bing results packed with those sponsored traps. Figure 2 shows the Artifact page dressed up as a normal Claude Desktop installer. Because the journey began on a real Claude.ai address, many users ran the file without a second thought.

ClaudeDesktop.exe is not the real app. It is a renamed, signed JetBrains helper that loads a tampered library beside it, a classic DLL sideloading malware attack that lets malicious code run under a trusted process name.

An identical copy called DockerDesktop.exe is later written as a scheduled task so the infection can restart after reboot.

A second signed program, sslconf.exe, appears under an EdgeUpdate folder and loads yet another altered library.

That stage checks graphics hardware and video memory to avoid sandboxes, then decrypts a hidden payload with a graphics shader instead of ordinary CPU code.

The final result is SectopRAT, which hunts browser logins, cookies, autofill data, credit cards, and messaging apps.

Command addresses are not hard-coded in plain text. They are pulled from Ethereum blockchain contracts, a method known as EtherHiding that lets operators change servers by posting new transactions that are hard to take down.

How Corporate Users Get Infected

Corporate staff often search for AI desktop tools during work hours and click the first convenient result.

That habit turns everyday research into a direct path for malware when ads and trusted domains are abused together.

Similar tricks have already appeared in shared Claude chats malware campaigns that also rode the Claude brand to look real.

Once inside, SectopRAT gives attackers remote control and a steady stream of stolen credentials and files.

Persistence through scheduled tasks and Defender exclusions keeps the foothold alive even after a reboot or a basic cleanup attempt. Huntress linked the same operator style to earlier fake Docker Desktop lures, showing this is not a one-off experiment.

Defenders should treat top-level domains with caution and never assume a familiar brand name equals a safe download.

Users should type official vendor addresses directly instead of trusting sponsored search results, and security teams should watch for unexpected ClaudeDesktop.exe or DockerDesktop.exe activity, new EdgeUpdate paths, and odd scheduled tasks.

Clear remote access Trojan practices still matter: keep software updated, limit unnecessary admin rights, and verify every installer against the vendor’s own site.

Huntress reported the malicious Artifact to Anthropic, and it was removed. The episode still underlines a wider lesson. As more people chase AI tools, both search ads and AI hosting features become attractive stages for malware that looks legitimate until it is far too late.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.