Hackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic’s legitimate claude.ai domain, exploiting content-sharing features to distribute malware.
The operation does not require compromising Anthropic’s infrastructure. Attackers publish malicious instructions through Shared Chats and public Artifacts, borrowing the platform’s domain and branding while persuading visitors to execute commands themselves.
The distinction is critical: authentic hosting does not make user-generated content an official software release.
The fraudulent pages appear under claude.ai/share/ and claude.ai/artifact/ paths, reproducing Claude’s logo, layout, and download messaging.
Although Claude displays warnings identifying this material as unverified user content, those notices compete with an otherwise convincing presentation. The genuine desktop download page is claude.com/download.
Researchers found Google advertising parameters, including gclid and gad_campaignid, in analyzed links.
Multiple Artifacts were tied to two advertising campaigns, suggesting a rotating distribution operation rather than an isolated malicious page. Another lure presented a shared conversation titled “Claude Code on Mac.”
Gen Digital researchers identified, separate macOS and Windows campaigns that turn apparently trustworthy pages into launchpads for credential theft, cryptocurrency targeting, and remote access.
Instead of delivering an installer, the macOS page offers a “Quick install via Terminal” workflow. Its copy button supplies an obfuscated command that visitors are instructed to paste and execute.
This ClickFix technique shifts execution to the victim while concealing the attacker’s infrastructure inside encoded content.
Executing the command initiates a staged infection chain. An initial loader retrieves and unpacks another script, which downloads and executes an AppleScript-based payload identified by Gen Digital as Atomic macOS Stealer, or AMOS.
The malware checks for Full Disk Access before collecting data. Without that permission, it displays a misleading access request and modifies a shell startup file so execution resumes when Terminal next opens.
Once authorized, it presents a counterfeit macOS password dialog that continues until the victim supplies a valid login password.
The stealer harvests browser passwords, session cookies, Keychain material, cryptocurrency wallets, and sensitive documents.
Collected information is compressed into a ZIP archive, uploaded to attacker infrastructure, and followed by temporary-file cleanup.
Its cryptocurrency component extends beyond immediate data theft. When Ledger Live, Ledger Wallet, or Trezor Suite is installed, the malware can replace the legitimate application with a trojanized version.
Subsequent “restore” or “validate” prompts solicit recovery phrases and send them to a separate collection server, enabling wallet theft.
The Windows variant uses another Claude Artifact and directs victims through Win+R, Ctrl+V, and Enter.
The pasted PowerShell command displays reassuring progress messages while retrieving a subsequent stage from a github.io page containing an encrypted, packed .NET payload.
The executable injects into a legitimate Windows process, checks installed antivirus products, captures screenshots, reads active window titles, and maintains an attacker-controlled connection.
It also searches for desktop cryptocurrency wallets and browser wallet extensions.
Researchers describe behavior consistent with remote-access tooling rather than a single-purpose stealer.
Download Claude through its official download page, not shared conversations or Artifacts. Avoid executing commands copied from advertising-linked installation prompts.
Anyone who ran these commands should treat the endpoint as compromised, revoke sessions, reset credentials from a clean device, and replace exposed wallet recovery phrases immediately.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…
OpenAI has introduced GPT-6 Cyber, a security-focused model built to find and validate exploitable vulnerabilities…
Melbourne, Florida, November 5th, 2026, CyberNewswire OpenMatter Network, a pioneer in decentralized infrastructure for agentic…
A China-aligned espionage group abused the update traffic of Sogou Input Method, one of China's…