Back Feeds.4Sysops

Malicious actors weaponize Claude Artifacts to distribute malware

Feeds.4Sysops •IT News • July 23, 2026

A recent malvertising campaign exploited the Claude Artifacts feature to distribute the SectopRAT information-stealing Trojan to at least 29 organizations. Attackers purchased engine advertisements that directed users to a spoofed download page hosted on the legitimate claude.ai domain. By leveraging this trusted platform, the attackers successfully bypassed typical user skepticism regarding software installation sources. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malvertising Campaign Distributes SectopRAT via Fake Claude Desktop App A malvertising campaign, dubbed FakeAgent, exploited Bing ads to distribute the SectopRAT malware through a fake Claude desktop app. Between July 21 and July 22, 2026, at least 29 organizations were compromised after users were misled to a malicious public Claude Artifact on the legitimate Claude.ai domain. The attackers used this artifact to redirect victims to a spoofed download site, where they unknowingly downloaded a malicious executable named ClaudeDesktop.exe. This executable, disguised as a legitimate app, sideloaded a malicious DLL to deliver SectopRAT, an information-stealing Trojan. The campaign leveraged anti-analysis techniques and utilized Ethereum blockchain transactions for command-and-control operations. The malicious artifact received over 7,100 page views before being removed by Anthropic. Huntress researchers played a crucial role in analyzing the attack and attributing it to SectopRAT operations. 7 sources 68

Extracted Entities

Malicious actors weaponize Claude Artifacts to distribute malware

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (1)