Cybercriminals are using the official Claude AI website to spread dangerous malware. Security researchers at Gen Digital recently found advanced scams that post fake installation guides right on the claude.ai domain.
The attackers use Anthropic features such as Artifacts and shared chats to share harmful content. Since these pages are on a real domain, common warning signs like misspelled web addresses are missing.
Paid Google ads put these fake pages at the top of search results. People looking for the Claude desktop app may click these sponsored links and end up on what looks like a real Anthropic help page. The only warning is a small banner that says the content is user-generated.
The attack changes depending on the victim’s operating system. Mac users are told to skip normal setups and run a special Terminal command. Running this command secretly installs Atomic Stealer, which collects saved browser passwords and session data. It also looks for cryptocurrency assets. The malware can even replace real financial apps with fake ones that steal recovery phrases.
Windows users face a similar risk, but it is disguised as a shortcut. The fake guide tells people to open the system Run dialog and paste a PowerShell command. This starts a ClickFix attack that gets around normal system protections.
The script then downloads a remote access trojan from GitHub. Once running, the trojan records screen activity and waits for more instructions from the attackers.
Hackers are increasingly targeting official AI domains. Similar fake pages have also appeared on the official ChatGPT website to spread trojans.
Users should be careful and only download software from the official download portal using standard installers. Real desktop apps never ask you to run complicated command scripts. If you ran one of these harmful commands by mistake, change your banking and email passwords right away from a clean device. Security experts also recommend moving your cryptocurrency to new wallets immediately.
