Fake Claude App on Bing Ads Delivers SectopRAT Malware

Malvertising Campaign Exploits Bing Ads to Distribute SectopRAT

A concerning malvertising campaign is actively leveraging Bing search advertisements to distribute the SectopRAT malware. Threat actors are impersonating the popular AI chatbot Claude, directing unsuspecting users to a seemingly legitimate Claude.ai domain where a malicious desktop application installer is hosted. This campaign highlights the evolving tactics of attackers who are increasingly sophisticated in their ability to blend in with legitimate online services and exploit user trust.

The campaign's primary vector is through Bing search ads. When users search for terms related to Claude, such as "Claude AI," "Claude chatbot," or "Claude.ai," they are presented with ads that appear to be official links to the service. However, these ads lead to a compromised or attacker-controlled landing page that mimics the official Claude website. The critical element of this attack is the use of a legitimate-looking domain, which significantly lowers user suspicion. Once on the fake site, users are enticed to download a desktop application for Claude.

The downloaded installer is not a legitimate Claude application. Instead, it is a trojanized installer designed to deploy the SectopRAT malware onto the victim's system. SectopRAT, also known as a RAT (Remote Access Trojan), grants attackers extensive control over the compromised machine. This allows them to steal sensitive information, monitor user activity, exfiltrate data, and potentially use the infected device as a pivot point for further network intrusions.

What makes this campaign particularly insidious is its reliance on the perceived trustworthiness of both Bing Ads and the Claude.ai domain. Search engines are often the first port of call for users seeking software or services, and ads prominently displayed at the top of search results are frequently clicked without deep scrutiny. By hosting the malicious installer on a domain that closely resembles or potentially even uses a subdomain of Claude.ai, the attackers create a strong illusion of legitimacy. This bypasses many users' standard security checks, which often include verifying the domain name.

The SectopRAT malware itself is a potent tool in the hands of cybercriminals. Its capabilities typically include:

• Keylogging: Recording all keystrokes made by the user.
• Screen capture: Taking screenshots of the user's activity.
• File system access: Browsing, downloading, and uploading files.
• Remote command execution: Running arbitrary commands on the victim's machine.
• Information theft: Targeting credentials, browser data, and other sensitive information.

The distribution method through malvertising is a growing concern. Attackers are finding it increasingly effective to purchase ad space on major search engines and ad networks to reach a broad audience. Unlike traditional phishing emails, which require users to open a malicious attachment or click a suspicious link in an email, malvertising attacks can infect users simply by them visiting a compromised webpage or downloading seemingly legitimate software from an ad. This lowers the barrier to infection for end-users.

BleepingComputer's investigation revealed that the attackers are hosting the fake Claude installer on a subdomain that closely mimics the legitimate Claude.ai domain. This could be achieved through various means, including domain spoofing, DNS poisoning, or compromising a legitimate subdomain. The use of a seemingly official domain is a critical social engineering tactic that preys on user habits and trust in established brands and platforms.

The implications of this attack are significant for both individual users and the broader AI landscape. For users, it represents a direct threat to their personal data and system security. Falling victim to this campaign could lead to identity theft, financial loss, and compromise of sensitive work-related information, especially if the user is an AI developer or researcher who might be using Claude for work-related tasks. For the AI community, it underscores the need for vigilance as malicious actors target popular AI services to exploit their growing user base. The trust placed in AI tools can be weaponized, making security awareness paramount.

While the specific actors behind this campaign have not yet been publicly identified, the use of SectopRAT suggests a financially motivated group or a sophisticated state-sponsored actor looking for initial access. RATs are versatile tools, often used for espionage or as a precursor to ransomware attacks. The fact that they are targeting users of a prominent AI service indicates a strategic effort to capitalize on the widespread adoption of AI technologies.

What remains unaddressed is the effectiveness of the ad platforms' moderation policies. While Bing and other ad networks have policies against malicious advertisements, sophisticated campaigns like this demonstrate that these measures are not always sufficient to prevent malicious ads from reaching users. The ability to host malicious payloads on domains that appear legitimate poses a significant challenge for automated detection systems and human reviewers alike. The speed at which these campaigns can be launched and scaled also outpaces the response times of ad platform providers.

Users are advised to exercise extreme caution when downloading software, especially when initiated from search engine advertisements. It is always recommended to navigate directly to the official website of the software vendor by typing the URL into the browser or using a trusted bookmark. For Claude, users should ensure they are accessing the service exclusively through the official Claude.ai website and avoid downloading any desktop applications unless officially provided and verified through secure channels. Security software should be kept up-to-date, and users should remain vigilant against social engineering tactics that exploit the popularity of AI tools.

The ongoing threat of malvertising campaigns targeting popular services like AI chatbots signifies a persistent and evolving threat landscape. As AI tools become more integrated into daily workflows, the potential for attackers to exploit this trust and convenience will only increase. Developers and security professionals must remain aware of these evolving tactics and implement robust security practices to protect themselves and their organizations.