How attackers hosted a fake Claude download page on the claude.ai domain

1. Executive summary

A threat actor abused Anthropic's Claude Artifacts feature to host a fake Claude desktop-app download page on the legitimate claude.ai domain, bypassing domain-reputation controls. Employees at at least 29 organisations were compromised over two days in July 2026 after clicking a sponsored Bing ad that directed them to the attacker-published public artifact, which then redirected to an external site serving the SectopRAT infostealer via DLL sideloading. The artifact was viewed 7,100 times before takedown. EMEA financial services firms should treat this as a demonstration that "trusted domain" allowlisting is insufficient: legitimate SaaS platforms with user-generated content can be weaponised to defeat proxy and email-security reputation checks.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The incident is a broad phishing/malware-delivery campaign targeting end-users via a third-party SaaS platform; it does not trigger a distinctive obligation under the provided regulatory reference that would change what a client must do beyond standard incident-response and endpoint-protection hygiene.

3. Technical analysis & attack chain

Confirmed attack chain (corroborated by Huntress research, single-sourced — verify before enforcement)

1. Initial access vector — malicious search ad. Victims searched Bing for the Claude desktop app and clicked a sponsored Bing advertisement. The ad pointed to the genuine claude.ai domain.
2. Trusted-domain abuse via Claude Artifacts. The ad URL resolved to an attacker-published public Claude Artifact. Artifacts are a Claude.ai feature that renders content (code, documents, full web pages) in a panel beside chat; users can publish an artifact to a public link viewable without a Claude account. The artifact rendered a fully functional fake Claude download page hosted on claude.ai. The only indicator of its nature was a small disclaimer in the upper-left corner: "Content is user-generated and unverified."
3. Redirect to external infrastructure. Clicking the "Download" button on the artifact page redirected victims to claude.ai.download-app[.]us, then to downloading-api.it[.]com/html/claude/win.
4. Payload bundle. The downloaded bundle contained three components: - A renamed but legitimate signed JetBrains binary vulnerable to DLL sideloading. - A tampered libcef.dll carrying the actual malware payload. - An executable named DockerDesktop.exe, dropped to disk and registered as a scheduled task for persistence and reinfection.
5. Malware — SectopRAT. A remote access trojan that grabs and exfiltrates user credit card data, personal information, files, and passwords.
6. Observed impact. At least 29 organisations compromised over two days in July 2026. The artifact page was viewed 7,100 times before Anthropic took it down (reported and removed before Huntress published findings on July 22, 2026).

Attribution and campaign links (single-sourced via Huntress; unconfirmed)

Huntress traced the operator through WHOIS records and the Validin intelligence platform. The download-app[.]us registration was tied to an email address linked to ten domains dating back to December 2025. One of those domains, polse[.]us, was seized by Microsoft during Operation Endgame for hosting the StealC infostealer. Huntress also connected the actor to an April 2026 campaign that used Docker Hub to distribute a fake Docker Desktop installer using the same libcef.dll sideloading technique and a trusted domain to disarm suspicion — explaining the leftover DockerDesktop.exe filename in this campaign's bundle. No MITRE ATT&CK actor profile has been resolved for this operator; attribution is unconfirmed.

4. Mitigation & containment

P1 — within 24 hours

• Block the following domains at web proxy, DNS sinkhole, and firewall: download-app[.]us, downloading-api.it[.]com, and polse[.]us (if not already blocked post-Operation Endgame).
• Hunt for DockerDesktop.exe in non-standard paths (i.e., not the legitimate Docker installation directory) across endpoints. Treat any instance outside C:\Program Files\Docker\ as suspicious and investigate the parent process and scheduled task registration.
• Search for and review scheduled tasks named DockerDesktop or referencing a DockerDesktop.exe binary in a non-standard path. Remove any confirmed malicious tasks.
• Scan endpoints for the tampered libcef.dll alongside a renamed JetBrains binary in the same directory — this pairing is the DLL-sideloading signature of this campaign.

P2 — within 72 hours

• Review web proxy and email-security logs for any user access to claude.ai/download-app[.]us or downloading-api.it[.]com since July 1, 2026. Any hit indicates a likely compromised endpoint requiring SectopRAT eradication.
• Add claude.ai to a "user-generated content" category in your web proxy if one exists, and apply the same scrutiny to artefact/public-link paths as to other file-sharing and code-hosting platforms. Do not allowlist SaaS domains wholesale.
• Brief staff: do not download software via search-engine sponsored ads; verify download URLs against the vendor's official website directly.

P3 — within 7 days

• Review your organisation's dependency on domain-reputation-based allowlisting for SaaS platforms. This incident demonstrates that legitimate domains hosting user-generated content (Claude Artifacts, similar features on other AI/developer platforms) can serve malware. Implement URL-path-level filtering rather than domain-level allowlisting for platforms with user-publishing features.
• Assess whether the Claude for Chrome extension (separate flaw reported by BleepingComputer — a malicious extension could trigger predefined AI actions by simulating user clicks, potentially abusing Claude's access to Gmail, Google Docs, Google Calendar, and Salesforce) poses an additional risk if the extension is deployed in your environment. If deployed, evaluate whether connected-service permissions are necessary.

5. Indicators of compromise

domain  claude.ai.download-app[.]us
domain  downloading-api.it[.]com
domain  polse[.]us
url  hxxps://downloading-api[.]it[.]com/html/claude/win
filename  DockerDesktop.exe
filename  libcef.dll
malware-family  SectopRAT

6. Detection

rule SectopRAT_Claude_Campaign_2026 {
    meta:
        author = "Adverse Trace"
        date = "2026-07-23"
        reference = "https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/"
        description = "Detects components associated with SectopRAT delivery via fake Claude download page — tampered libcef.dll and DockerDesktop.exe dropper"
    strings:
        $dropper_name = "DockerDesktop.exe" wide ascii
        $sideload_dll = "libcef.dll" wide ascii
        $disclaimer = "Content is user-generated and unverified" wide ascii
    condition:
        2 of them
}

title: Suspicious DockerDesktop.exe Scheduled Task in Non-Standard Path
id: AT-2026-07-23-384-001
status: experimental
description: Detects scheduled task creation referencing DockerDesktop.exe outside the legitimate Docker installation directory, consistent with SectopRAT persistence via DLL sideloading campaign
references:

    - https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/
author: Adverse Trace
date: 2026/07/23
logsource:
    product: windows
    category: process_creation
detection:
    selection_task:
        Image|endswith: '\schtasks.exe'
        CommandLine|contains:

            - '/create'
            - 'DockerDesktop'
    filter_legitimate:
        CommandLine|contains:

            - 'C:\Program Files\Docker\'
    condition: selection_task and not filter_legitimate
falsepositives:

    - Legitimate Docker Desktop scheduled task creation (verify path)
level: high

7. Sources

• Help Net Security — "How attackers hosted a fake Claude download page on the claude.ai domain" — https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/ — 2026-07-23
• BleepingComputer — "Claude Chrome extension flaw lets malicious extensions trigger AI actions" — https://www.bleepingcomputer.com/news/security/claude-chrome-extension-flaw-lets-malicious-extensions-trigger-ai-actions/ — (related context)

8. Adverse Trace position

This is a medium-severity incident for EMEA financial services. The core risk is not a vulnerability in Claude itself but the abuse of a legitimate platform's user-generated-content feature to defeat domain-reputation controls — a pattern that will recur across AI and developer SaaS platforms. The 29 confirmed organisational compromises and 7,100 artifact views over just two days indicate an effective and scalable delivery mechanism. The SectopRAT payload (credit card, credential, and file exfiltration) is a direct concern for any financial services environment where employees may use corporate devices for AI tooling. Attribution to a single operator linked to StealC distribution and a prior Docker Hub campaign is single-sourced via Huntress and unconfirmed. We will monitor for additional domains tied to the same WHOIS email address, track whether Anthropic implements publisher verification for public Artifacts, and assess whether similar abuse surfaces on competing AI platforms with public-sharing features.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.