Fake Claude app promoted by Bing ads pushes SectopRAT malware - BleepingComputer

What the report says

BleepingComputer reports that a malvertising campaign on Microsoft’s Bing search platform promoted a counterfeit Claude desktop application that installed SectopRAT malware. The activity, described by Huntress researchers as “FakeAgent,” reportedly compromised at least 29 organizations over July 21-22, 2026. The lure used a malicious Claude Artifact hosted on Claude.ai infrastructure, giving the phishing flow the appearance of legitimacy before sending users to sites offering a fake ClaudeDesktop.exe installer.

According to the report, Huntress found the Claude Artifact had been downloaded 7,100 times before Anthropic removed it. The downloaded file was described as a legitimate JetBrains Chromium component abused to sideload a malicious libcef.dll, which then delivered SectopRAT. The infection chain also used a file named DockerDesktop.exe to create persistence through a scheduled task. Huntress said the loaders included anti-analysis features such as VMProtect packing and checks for graphics hardware, shader timing and virtual machines.

BleepingComputer notes that SectopRAT, also known as ArechClient2, has been active since 2019 and functions as an information stealer with hidden remote-control capabilities. The malware can support hands-on access to infected systems and target data including passwords, browser cookies and logins, files, FTP credentials, payment-card data, VPN-related information and content from apps such as Discord, Telegram and Steam.

The report says Huntress linked the payload to SectopRAT operations or a closely related fork but did not have enough evidence to name a specific threat group behind FakeAgent. The case underscores the risk of sponsored search results in software downloads; users and IT teams are advised to rely on official download pages rather than ads or search-result links.