Fake Claude app promoted by Bing ads pushes SectopRAT malware

A malvertising campaign called FakeAgent used a malicious Claude artifact hosted on a legitimate Claude.ai domain and promoted via Bing ads to push a fake ClaudeDesktop.exe that sideloads libcef.dll to deploy SectopRAT — an information-stealer with HVNC — resulting in at least 29 organizations compromised and roughly 7,100 downloads; the infection chain includes scheduled-task persistence (DockerDesktop.exe), anti-analysis measures, and an EtherHiding technique for C2 retrieval.