Hackers Abuse Claude's Official Website and Google Ads to Distribute Malware
Attackers are leveraging Anthropic's official claude.ai website and Google Ads to host fake desktop app installers, distributing the Atomic macOS Stealer (AMOS) and a Windows variant.
Cybercriminals have devised a sophisticated method to distribute malware by abusing Anthropic's official claude.ai website, the trusted domain for the Claude AI assistant. Instead of relying on deceptive domain names, attackers are hosting malicious content directly on claude.ai as user-generated Shared Chats or public Artifacts. These pages mimic legitimate Claude branding and offer seemingly straightforward instructions for installing a desktop application, thereby exploiting the trust associated with the official domain and its security indicators like the padlock icon.
To amplify their reach, the threat actors are also utilizing Google Ads to promote these malicious pages. This tactic ensures that the fake installers appear prominently in search results, leading unsuspecting users directly to the compromised content. Researchers from Gen Digital identified these campaigns, noting the presence of Google Ads tracking parameters like gclid and gad_campaignid within the malicious links, confirming the paid promotion aspect of this operation. The discovery of multiple rotating Artifacts tied to distinct ad campaigns indicates a funded and ongoing effort rather than a isolated incident.
The macOS variant of the attack employs a technique known as ClickFix. Users are instructed to open the Terminal application and paste a scrambled command. This command, when executed, installs the Atomic macOS Stealer (AMOS), a potent information-stealing malware. AMOS is designed to pilfer credentials, browser session data, and cryptocurrency wallet information. Disturbingly, it can also replace legitimate desktop applications for hardware wallets like Ledger and Trezor with modified versions that prompt users to reveal their recovery phrases, a critical step in compromising cryptocurrency holdings.
A parallel campaign targeting Windows users employs a similar strategy but with a different payload. The Windows lure, presented as an "Install Claude on Windows" Artifact, instructs users to execute a PowerShell command via a specific key combination. This command fetches an encrypted .NET payload from a GitHub-hosted page. Once executed, the malware hides within legitimate Windows processes, attempts to disable antivirus software, captures desktop screenshots, and establishes a remote connection for further command execution by the attacker.
Both the macOS and Windows payloads are designed for extensive data theft. The Windows variant specifically targets various cryptocurrency wallets, including Electrum, Exodus, Ethereum, and Bitcoin, alongside Ledger and Trezor. The macOS version, AMOS, is also known to steal sensitive files such as PDFs, Word documents, key files, and wallet-related data. The sophistication of these attacks lies in their ability to bypass common security measures by leveraging trusted platforms and social engineering techniques that encourage user interaction.
Researchers emphasize that this campaign highlights a growing trend of threat actors exploiting legitimate platforms and services to lend credibility to their malicious activities. The use of user-generated content on trusted domains, combined with paid advertising, creates a highly convincing lure. The ClickFix technique, where users are prompted to execute commands they don't fully understand, is particularly effective in bypassing security controls that might otherwise flag suspicious scripts.
Gen Digital's analysis provides clear recommendations for users to protect themselves. It is crucial to avoid pasting commands into the Terminal or PowerShell that have not been personally written or verified. Users should always navigate to vendor websites directly, preferably through bookmarks, rather than relying on search engine results or unsolicited links. Treating "user-generated" content labels as significant warnings and never entering recovery phrases into unexpected prompts are also vital precautions.
For individuals who may have executed these malicious commands, the advice is to assume their device is fully compromised. This necessitates immediate actions such as changing all critical passwords, logging out of active sessions across all services, enabling multi-factor authentication wherever possible, and transferring cryptocurrency assets to a newly generated wallet with a fresh recovery phrase. The campaign underscores the evolving tactics of cybercriminals who are increasingly sophisticated in their methods to deceive users and compromise sensitive data.