Fake Claude app promoted by Bing ads pushes SectopRAT malware

A malvertising campaign on the Bing search service is promoting a fake Claude desktop app installer that delivers SectopRAT malware. Ads point users to an installer hosted on a legitimate Claude.ai domain, which can make the download appear trustworthy at a glance. The payload is SectopRAT, not a genuine Anthropic Claude client.

The campaign uses paid search ads to surface the fake installer when people look for Claude software. Hosting the installer on a legitimate Claude.ai domain reduces the chance that domain reputation checks or casual URL inspection will flag it. That combination—trusted search placement plus a real brand domain—is the core delivery mechanic, not a novel exploit chain or disclosed CVE set.

For engineers and builders, the risk is download hygiene around AI tooling. Teams that search for desktop clients, agents, or productivity apps via Bing can land on ad results before organic links. An installer that looks brand-aligned and sits under a legitimate Claude.ai host is easy to accept without verifying publisher identity, code signing, or checksums. Remote access trojans like SectopRAT turn a one-time install into persistent access on developer machines that often hold tokens, SSH keys, and cloud credentials.

Malvertising that abuses major search ads and legitimate brand domains sits in a crowded threat pattern: high-intent product searches, brand spoofing, and living-off trusted infrastructure. Claude is a high-demand target name, so fake desktop apps are a natural lure. Bing is the distribution channel here; the same playbook can appear on other ad networks whenever a consumer AI product has strong brand pull and users expect a downloadable client.

Treat Bing ad results for Claude (and similar AI apps) as untrusted until the install path matches official Anthropic channels. Prefer direct links from Anthropic documentation or the product site over sponsored results. On any machine that already ran a suspicious Claude installer, assume compromise until SectopRAT and related persistence are ruled out. Watch for further reports that map the ad creatives, landing paths, and whether Microsoft or Anthropic take enforcement action against the campaign.