Hackers hid dangerous malware on a page hidden in Anthopic's Claude.ai domain

Date:
Fri, 24 Jul 2026 14:20:00 +0000

Description:
Claude Artifacts have been used as phishing lures, once again, this time to deliver a dangerous RAT.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Huntress spots malicious Claude Artifact spoofing Claude Desktop, spreading SectopRAT malware Victims were redirected via Bing ads, infecting at least 29 organizations between July 2122, 2026 Claude removed the artifact after 7,000+ views; malvertising risks persist despite disclaimers on artifacts At least 29 organizations have been infected with a Remote Access Trojan (RAT) after mistaking a public Claude Artifact for a legitimate Claude page.

A Claude Artifact is an interactive document, or piece of code, that the AI generates and then hosts on the Claude platform. It can then be shared with other people as an example, or proof of concept, for different solutions. The link to an artifact usually looks something like this: claude[.]ai/public/artifacts/ca466f1f-21c0-42af-b329-8f1c7534a891 Latest Videos From TechRadar Watch full video here:

Claude Artifacts are often used for phishing and other forms of scams, and weve seen it in ClickFix attacks in the past. Claude responded by adding a disclaimer to every artifact, stating that the content is user-generated and thus unverified.

In this particular case, a malicious artifact was created to spoof the download page for Claude Desktop. Victims would get redirected to an attacker-controlled domain, where instead of the Claude app, theyd download SectopRAT, a remote access trojan capable of stealing credit card data, personal information, files, passwords, and more. You may like 'Threat actors are clearly adapting to the widespread interest in popular AI tools': AI fans beware, hackers create a fake Claude site to spread backdoor malware Experts warn Claude feature hijacked by hackers to launch major malware campaign Mac users beware scammers are hijacking Claude chats and Google ads to push malware Promoting the scam The artifact was then promoted on Bing, showing up at the very top of search results to people searching for Claude Desktop App.

For years, the cybersecurity community has warned about malvertising, urging users to double-check the domain before clicking on any links, even promoted ones. However, the problem here is that the ad takes the victims to the legitimate Claude domain, making scrutiny that much harder. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get
all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting
your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

The campaign was spotted by security researchers Huntress , who said that between July 21 and July 22, 2026, their SOC lit up with a swathe of unusual executable installs, Defender exclusions, and anomalous persistence across 29 organizations, all coming from ClaudeDesktop.exe.

Claude has since removed the malicious artifact, but not before it raked up more than 7,000 views. It is possible that other organizations, outside Huntress field of view, also fell victim to this scam. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/hackers-hid-dangerous-malware-on-a-page -hidden-in-anthopics-claude-ai-domain


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)