cyber.hendryadrian.com
Threat Research · huntress.com

Fake Claude Desktop Ads Deliver SectopRAT to 29 Organizations

· Original article ↗

Summary

Huntress reports that malvertising led users to a malicious Claude Artifact and fake desktop installer, delivering SectopRAT to at least 29 organizations. The campaign used DLL sideloading, GPU anti-VM checks, and blockchain-based C2; Anthropic removed the artifact.

Key points

  • Between July 21 and 22, 2026, at least 29 organizations were affected after search ads led users to a malicious public Claude Artifact.
  • The artifact redirected users to attacker-controlled sites that provided a fake ClaudeDesktop.exe installer, which downloaded and staged the malware.
  • The campaign used DLL sideloading and a scheduled task for persistence; the malware masqueraded as trusted applications.
  • Huntress identified the payload as SectopRAT, which can steal browser credentials, cookies, payment-card details, personal information, and files.
  • The malware used VMProtect, GPU-based anti-VM checks, shader-based decryption, and Ethereum BSC transactions to retrieve changing C2 information.
  • Anthropic removed the malicious artifact after Huntress reported it; it had received about 7,100 views before removal.

Article Details

Attack Vectors
  • Sponsored Bing results led users searching for Claude Desktop to a malicious public Claude Artifact hosted on Claude.ai.
  • The artifact redirected users to attacker-controlled download infrastructure that served a malicious executable disguised as Claude Desktop.
  • The malware used DLL sideloading with a tampered libcef.dll and, in a separate persistence path, tempdir.dll.
  • A malicious executable was written as a scheduled task to repeatedly reinfect the computer.
  • The malware retrieved command-and-control information through Ethereum BSC transactions and used GPU checks to avoid execution in virtual machines or sandboxes.
  • The payload used VMProtect, obfuscation, and a DirectX shader-based decryption routine.
Defensive Notes
  • Use exceptional caution with sponsored search results and malvertising when downloading software.
  • Do not trust a link solely because it uses a legitimate top-level domain; the malicious artifact was hosted on Claude.ai.
  • Huntress reported the malicious Claude Artifact to Anthropic, and it had been removed as of publication.
  • The article reports unusual executable installs, Defender exclusions, and anomalous persistence as activity observed across affected organizations.

Indicators of compromise

TypeIndicatorContext
DOMAIN5ca8758c-02d0-4a72-89c8-d468b66dda41[.]comBackup domain identified for SectopRAT.
DOMAINdownload-app[.]usDomain identified as the redirect domain for the malicious ClaudeDesktop.exe download.
DOMAINpolse[.]usDomain identified by Microsoft as hosting StealC stealer malware.
HOSTNAMEclaude[.]ai[.]download-app[.]usAttacker-controlled redirect host used to send users to the malicious download.
IPV4104[.]194[.]133[.]210Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]17[.]143Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]20[.]32Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]20[.]95Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]21[.]86Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]22[.]118Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]24[.]255Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]24[.]67Historical command-and-control address recovered from BSC transactions.
IPV4107[.]189[.]26[.]86Historical command-and-control address recovered from BSC transactions.
IPV4191[.]101[.]80[.]211Historical command-and-control address recovered from BSC transactions.
IPV4195[.]110[.]58[.]222Historical command-and-control address recovered from BSC transactions.
IPV42[.]24[.]131[.]246Live SectopRAT command-and-control address identified in the investigation.
IPV445[.]59[.]114[.]190Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]117[.]145Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]117[.]67Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]122[.]134Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]122[.]235Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]122[.]82Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]123[.]122Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]124[.]17Historical command-and-control address recovered from BSC transactions.
IPV445[.]59[.]125[.]228Historical command-and-control address recovered from BSC transactions.
SHA2561cd58cfba596da296ab1878d74023e00c399345a1b6c2a0e5446c53563f4e3bbSHA-256 hash of the malicious tempdir.dll.
SHA2561fe3646d27d286db8123297e06ae7badf3e26f352a04f91b6d82c28869a91664SHA-256 hash of the embedded SectopRAT payload.
SHA25626bae4d7012bf59847ab4036a065419c3d4ca47e020479f55b3b2c6d0d21394aSHA-256 hash of the tampered, malicious libcef.dll.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe malware used VMProtect, obfuscated .NET code, and encrypted payload data to hinder analysis.T1053.005 · Scheduled TaskDockerDesktop.exe was written to disk as a scheduled task to repeatedly reinfect the computer.T1105 · Ingress Tool TransferThe initial executable downloaded and staged the payload, and the Ethereum contract data led to a payload download.T1204.002 · Malicious FileUsers downloaded and executed the malicious ClaudeDesktop.exe file.T1497.001 · System ChecksThe malware checked graphics adapters, VRAM, and shader timing to detect virtual machines or sandboxes before executing.T1555.003 · Credentials from Web BrowsersThe SectopRAT payload was described as targeting browser logins, cookies, autofill data, and Chromium key material.T1574.002 · DLL Side-LoadingThe malware used tampered libcef.dll and tempdir.dll alongside trusted executables for DLL sideloading.T1608.006 · SEO PoisoningThe campaign used sponsored search results and SEO poisoning to direct users to the malicious download page.

People

Michael TiggesNamed author of the Huntress investigation.

Malware

SectopRATHomeBlogInside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRATStealCcommand and control services. Specifically, the domain polse[.]us was identified by Microsoft as hosting StealC stealer malware.

Vendors

AnthropicWe reported the malicious Claude Artifact to Anthropic; as of publication on July 22, the public Claude Artifact had been removed.IBMSslconf.exe is once again a signed application—in this case, an IBM SPSS binary. IBM SPSS is a statistical analysis platform; so another legitimate and unremarkable application that's widely used in many verticals. JetBrainsIt's worth noting that ClaudeDesktop.exe is not actually ClaudeDesktop.exe, but instead a component of JetBrains' jcef_helper.exe, a Chromium Embedded Framework application. MicrosoftAn additional persistence mechanism was written to %APPDATA\Roaming\Microsoft\EdgeUpdate\Install\sslconf.exe, so we can explore this next.

Products

Bingpractitioners for some time now. This attack is no different. The user performed an innocuous Bing search for  "CLAUDE DESKTOP APP". As shown in Figure 1, the sponsored results were filled with fake pagesClaudeHomeBlogInside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRATClaude DesktopHomeBlogInside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRATDefender2026, Huntress' Security Operations Center (SOC) lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe. TheDocker Desktopinternally tracked in April 2026, where the same individual utilized Docker Hub to distribute a fake Docker Desktop install with similar tactics, utilizing libcef.dll sideloading to distribute malware under the guiseIBM SPSSSslconf.exe is once again a signed application—in this case, an IBM SPSS binary. IBM SPSS is a statistical analysis platform; so another legitimate and unremarkable application that's widely used in many verticals. 

Tools

BinaryNinjadramatically different from the Intermediate Languages that reverse engineering platforms such as BinaryNinja utilize.ILSpyBooting up ILSpy, a common .NET decompiler, we are immediately inundated with a heavily obfuscated .NET payload. Plaintext strings include references to browser logins, cookies, autofills, credit cards, chromium keyValidinWithin our analysis, we pivoted on several fields using a combination of public WHOIS records and the Validin intelligence platform. We were able to identify the email address used to register the maliciousVMProtectThe attackers used an array of anti-analysis techniques, including packaging the malware with VMProtect to make it difficult to reverse engineer and checking the graphics hardware on systems before deciding whether to

Related Articles