How attackers hosted a fake Claude download page on the claude.ai domain

Huntress disclosed that attackers abused Anthropic’s Claude Artifacts to publish a fake Claude desktop download page hosted on the claude.ai domain, which redirected victims who clicked a sponsored Bing ad to external sites that delivered a bundle installing SectopRAT via DLL sideloading (tampered libcef.dll alongside a signed JetBrains binary), with a DockerDesktop.exe scheduled task for persistence; the RAT exfiltrates credit-card data, personal information, files, and passwords, and attribution links tie the operator to prior campaigns and domains including one seized during Operation Endgame.