A malware campaign is using pages hosted on Anthropic’s own claude.ai domain to trick people searching for Claude downloads into installing infostealers and a remote access trojan. Gen Digital researcher Vojtech Moravec found the lures, which were reported on October 28. The discovery date was not given beyond October 2026, and the account rests on a single source.
How the Lures Use claude.ai Itself
The attackers host malicious content on the real claude.ai domain by using Shared Chats and public Artifacts. Because the pages sit on Anthropic’s domain, they carry a valid certificate and an official address, removing two warning signs a visitor might otherwise check.
Anthropic displays a small banner noting that the content is unverified, which is the main visible indication that the page is user-generated.
Google Ads Sponsored Placements as the Delivery Route
Traffic reaches the pages through Google Ads sponsored placements. The links carried tracking parameters from two separate ad campaigns, indicating that more than one paid effort was directing people to the lures.
ClickFix Instructions and the Payloads
The pages present fake install instructions in the style known as ClickFix, in which victims are told to run commands themselves. The commands lead to malware that depends on the victim’s operating system.
Atomic macOS Stealer and Trojanized Wallet Apps
macOS victims receive Atomic macOS Stealer and trojanized wallet applications. The inclusion of wallet apps points toward cryptocurrency theft as a goal.
A .NET Remote Access Trojan for Windows
Windows victims receive a .NET remote access trojan, which gives the operator remote control of the infected machine.
The “John Gol” Profile and Fake Claude Code Guide
One lure appeared under the profile name “John Gol” and promoted a fake guide for installing Claude Code on a Mac. The targeting of people looking for a developer tool suggests the attackers aimed at users likely to be comfortable running terminal commands.
No Attribution Yet for the Fake Claude Campaign
No known group has been identified. The activity is suspected to involve financially motivated affiliates who rent stealers to drain crypto accounts. The number of victims is unknown, and the source does not state whether Anthropic or Google has responded.
The single-source basis limits what can be said. Details about the campaign’s duration, the volume of ad impressions and the infrastructure behind the payloads were not provided.
What the Technique Shows About Trusted-Domain Abuse
The campaign illustrates an approach in which attackers do not need their own domain or certificate. User-generated content features on a reputable site supply both. The same pattern would apply to any service that lets users publish shareable pages under the service’s own address.
Pairing that hosting with paid search placement addresses the other half of the problem, which is getting victims to the page. A person who searches for a legitimate product, clicks a sponsored result and lands on a page at the vendor’s real domain has few visible reasons for suspicion.
The impact described is credential and cryptocurrency theft from users who run the supplied commands. Updates from Gen Digital, Anthropic or Google on takedown of the lures and ad campaigns would clarify how long the pages stayed live.
Anthropic’s unverified-content banner is the only on-page signal the report mentions, and the researcher describes it as small. The tracking parameters on the ad links also reveal infrastructure: they let Gen Digital tie the lures to two separate ad campaigns. The report does not say how many people clicked the ads or ran the commands. Both macOS and Windows payloads are covered, so the campaign targets users regardless of platform, and the single-source status means further reporting may add detail.
