Fake Claude Desktop App Distributed via Bing Ads Delivers SectopRAT

BleepingComputer reports a malvertising campaign running through Bing search ads that promotes a fake Claude desktop application. According to the report, the malicious installer is being hosted on a domain within the legitimate Claude.ai infrastructure, and victims who download and run it are infected with SectopRAT malware.

Why It Matters

This campaign abuses trust in a well-known AI brand and a legitimate-looking domain to bypass user suspicion, a technique that has proven effective in prior malvertising campaigns targeting other popular software (browsers, chat apps, remote-access tools). SectopRAT is a remote access trojan capable of credential theft, browser data harvesting, and remote control of infected hosts. Anyone who searches for "Claude" or "Claude desktop app" via Bing and clicks a sponsored result is potentially at risk, including individual developers and enterprise users evaluating AI coding assistants.

What Defenders Should Watch For

• Educate users to install AI/desktop tools only via official first-party links bookmarked in advance, not via search engine ads.
• Monitor for anomalous process trees where a browser spawns an installer executable shortly after a search-engine referral, followed by unexpected outbound network connections.
• Watch endpoint telemetry for known SectopRAT behaviors: browser credential/cookie access, injection into legitimate processes, and C2 beaconing shortly after a new/unsigned or unusually-named installer executes.
• Consider ad-blocking or DNS-layer filtering for known malvertising infrastructure, and review browser/search ad exposure policies for security-conscious roles.
• Flag installers downloaded from subdomains or paths on legitimate-looking domains that don't match the vendor's documented distribution channels.

This is a developing story based on a single source, and full technical indicators (specific domains, hashes, C2 infrastructure) had not yet been detailed at the time of this write-up. Defenders should treat details as preliminary and refer to the original reporting for updates: BleepingComputer.