Fake Claude Desktop App Spread SectopRAT to 29 Orgs

You search "Claude Desktop app" on Bing. The top sponsored result looks right, it even points to claude.ai. You click, hit download, run the installer, and thirty seconds later a remote access trojan with a hidden virtual desktop is quietly logging into your browser sessions.

That's not a hypothetical. Between July 21 and July 22, 2026, security firm Huntress tracked a campaign it named FakeAgent that turned Anthropic's own platform into a malware delivery point, compromising at least 29 organizations in two days.

Key Takeaways

• Huntress documented the FakeAgent campaign running July 21 to 22, 2026, and confirmed it compromised at least 29 organizations through a fake Claude Desktop installer.
• Attackers hosted the installer as a public Claude Artifact on Anthropic's own claude.ai domain, and the page was downloaded 7,100 times before Anthropic removed it, according to Help Net Security.
• The installer, ClaudeDesktop.exe, is a repurposed JetBrains jcef_helper.exe binary that sideloads a malicious libcef.dll to launch SectopRAT, a .NET remote access trojan and infostealer active since 2019.
• SectopRAT resolves its command and control address through Ethereum blockchain transactions, a technique called EtherHiding, which makes the infrastructure resistant to conventional domain takedowns.

How Did Malware End Up Hosted on Claude.ai Itself?

Attackers didn't need to spoof Anthropic's domain, because they published the malware directly on it, using a Claude Artifact, a feature that lets any user host interactive content on claude.ai. Victims searching "Claude Desktop app" on Bing saw a sponsored ad that, unlike the obviously fake domains around it, pointed to a genuine claude.ai URL. The artifact imitated Anthropic's official download page, and its Download button redirected through a chain of attacker registered domains, from claude.ai.download-app[.]us to downloading-api.it[.]com, where the payload, ClaudeDesktop.exe, was actually served.

Huntress found ten auxiliary domains registered to the same email address going back to December 2025. Hosting the lure on a trusted domain sidesteps almost every heuristic security teams use to flag malicious ads, since the initial click resolves to a domain with a clean reputation and a valid certificate, a point Help Net Security raised in its own coverage of the campaign.

What Happens When You Run ClaudeDesktop.exe?

Running the file doesn't launch a fake app, it launches a real one first. ClaudeDesktop.exe is a legitimate, signed jcef_helper.exe binary lifted from JetBrains' Chromium Embedded Framework tooling, harmless on its own. The attackers pair it with a tampered libcef.dll in the same folder, and because Windows loads DLLs by name from an executable's own directory before checking anywhere else, the real binary sideloads the malicious one without tripping the warnings an unsigned executable would raise, according to Huntress's technical writeup.

The loader is unusually elaborate for a commodity RAT. It's packed with VMProtect, checks GPU vendor strings and VRAM to detect sandboxes, and decrypts its final .NET payload with AES-256-CTR run inside a DirectX shader instead of plain CPU code, aimed at analysis pipelines that don't emulate graphics hardware. Huntress used Claude to help reconstruct the shader bytecode and traced an early decryption failure to a single mistranscribed byte. Once running, a second copy of the binary, DockerDesktop.exe, lands in %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install as a scheduled task, so the infection survives a reboot or partial cleanup.

What Is SectopRAT, and What Does It Steal?

SectopRAT, also tracked as ArechClient2, is a .NET remote access trojan with built in infostealing features that G DATA researchers first documented in 2019, a seven year old workhorse still getting redistributed through fresh lures. Its signature feature is HVNC, hidden virtual network computing, which spins up an invisible desktop the attacker can drive by remote control while the victim keeps using their real screen. It also grabs saved browser logins, autofill entries, credit card fields, and Chromium encryption keys, plus FTP credentials and session data from Discord, Telegram, Steam, and VPN clients. G DATA found the malware added AES-256 encrypted command and control traffic back in 2021, evidence of an operator maintaining the tool rather than abandoning it after each detection round.

How Does SectopRAT's Command Infrastructure Survive Takedowns?

By living somewhere no company or registrar can delete. SectopRAT resolves its command server through Ethereum blockchain transactions, a dead drop technique called EtherHiding: the malware queries a smart contract, one of two addresses Huntress identified, and decodes the current C2 address from the data it returns. That data lives on every Ethereum node worldwide, so there's no host to seize and no registrar to notify, only a transaction the operator can send to move the address.

The technique isn't unique to this campaign. REMUS, an infostealer targeting password managers, used the identical EtherHiding pattern back in May, suggesting the dead drop has graduated from novelty to a default component. One of FakeAgent's ten domains had already distributed the StealC infostealer and was seized months earlier under Europol's Operation Endgame. The operator simply rebuilt around a seized domain's neighbors instead of disappearing, proof that seizures disrupt a campaign's plumbing without touching the person holding the wrench.

Who's Behind FakeAgent, and How Big Is the Real Blast Radius?

Nobody knows yet, and 29 is almost certainly a floor, not a ceiling. Huntress hasn't tied FakeAgent to a named threat actor, only to reused infrastructure: domains registered to one email address, overlap with an April Docker Hub malware scheme, and a recycled StealC domain neighbor. It's also the second fake Claude campaign in three months, after a Beagle backdoor distributed through a lookalike claude-pro[.]com site in May 2026.

What's measurable is the gap between reach and confirmed damage. The malicious page drew 7,100 views before Anthropic took it down, yet Huntress could only confirm compromise at 29 organizations, its own customer base. Anyone who ran the file outside Huntress's visibility doesn't show up in that number, so the true infection count, across everyone who searched for a Claude desktop app that week, is very likely a multiple of 29.

Why Email Users Should Care

FakeAgent spread through a search ad, not an inbox, but the payoff runs straight through email anyway. SectopRAT harvests saved browser credentials and live cookies, and for most people that includes an already logged in Gmail, Outlook, or corporate webmail session in a browser tab. A stolen session cookie skips the password and the MFA prompt entirely, handing an attacker the same access a legitimate sign in would, close to the mechanism behind a separate Outlook mailbox hijacking campaign from July 2026. Once inside a mailbox, the playbook is familiar: read existing threads, impersonate the account holder, send convincing follow ups to coworkers who already trust the sender.

That's the part a fake installer story easily obscures. The infection looks like a desktop malware problem, but the asset attackers actually want is whatever a browser has already authenticated into, and email is the account that unlocks the most other accounts through password resets.

What Should Security Teams and Developers Do Now?

• Block or flag sponsored search results for software downloads at the network or browser level instead of trusting a landing page's domain reputation alone, since this campaign shows a trusted domain can host attacker content.
• Treat any desktop app install triggered by a search ad as high risk regardless of which domain serves it, and route AI tool installs through a vetted internal package manager instead.
• Watch for jcef_helper.exe, libcef.dll, or similarly named JetBrains Chromium Embedded Framework files executing outside a development environment, especially alongside a scheduled task write to %APPDATA%\Roaming\Microsoft\EdgeUpdate\Install.
• Flag outbound connections to public Ethereum RPC endpoints, like Infura or Alchemy, from consumer desktop processes, a pattern unusual enough on business machines for EDR network telemetry to catch early.
• Match endpoint and firewall logs against Huntress's published indicators, including the SHA256 hashes for tempdir.dll, libcef.dll, and the SectopRAT payload, plus the C2 IP 2.24.131[.]246 and the download-app[.]us domain family.

None of this requires new tooling, only treating a familiar domain as one data point rather than a guarantee, which is exactly the assumption FakeAgent was built to exploit.

Sources: Huntress, BleepingComputer, Help Net Security, G DATA, and Operation Endgame.