What happened
Huntress disclosed (July 22-23, 2026) a malvertising campaign dubbed FakeAgent in which attackers abused Anthropic's Claude Artifacts feature — user-generated content hosted natively on claude.ai — to serve a fully convincing fake Claude Desktop download page. The infrastructure was linked to prior campaigns (StealC, Operation Endgame seizures) dating back to 2025.
Why it matters
This shows that GenAI platforms' own trusted-content features (artifact/canvas/sharing surfaces) can be weaponized as a supply-chain distribution vector for malware, defeating domain-trust heuristics that users and even some security tooling rely on ('it's hosted on claude.ai, it must be legitimate'). As more AI vendors add user-content hosting to their core products, this attack class is likely to recur across ChatGPT, Gemini, and other platforms.
Attack vector
Threat actor bought sponsored Bing ads for 'Claude Desktop App' leading to a spoofed download page hosted as a public Claude Artifact directly on the trusted claude.ai domain. Clicking Download redirected victims through attacker-controlled domains to a fake ClaudeDesktop.exe (a renamed/tampered JetBrains CEF helper with a malicious libcef.dll via DLL sideloading) that deployed the SectopRAT remote-access trojan, using VMProtect packing, GPU-based anti-analysis, and blockchain-based C2.
Affected systems
Anthropic Claude Artifacts feature (claude.ai public artifact hosting)
Mitigation
Anthropic removed the malicious artifact after Huntress's report; organizations should treat any AI-vendor 'Artifacts'/user-generated-content hosting feature as untrusted third-party content even when served from the vendor's own domain, and validate installers via official channels only.