Fake Claude Download Pages on claude.ai Spread Malware Through Google Ads

A malvertising campaign is turning one of the most trusted signals on the web against users. Instead of registering a lookalike domain, the operators built fake "Download Claude" pages directly on claude.ai, Anthropic's legitimate domain, and paid for Google Ads to put them near the top of search results. Anyone who followed the "installation" steps ended up running an infostealer.

What happened

Claude lets users publish Shared Chats and public Artifacts. Both are ordinary sharing features, and both render under the real claude.ai domain with a valid certificate and Anthropic's branding. The attackers used exactly these features to host pages styled as official download portals, complete with the Claude logo, a "Download for macOS" button and a "Get started" section.

There was no installer behind the button. Instead, the page presented an "Install on macOS" box with four steps: open Terminal, click Copy, paste, press Enter. The copied command was obfuscated, so the victim saw a string of gibberish rather than a suspicious web address. This is the ClickFix technique: the user runs the malicious command with their own hands, which sidesteps many of the controls that would block a downloaded executable.

The links carried Google Ads tracking parameters, which confirms the pages were promoted through paid search. Several rotating Artifacts were tied to two separate ad campaigns, so this was a funded, ongoing operation rather than a one-off.

Claude does display a thin banner noting that the content is user-generated and unverified. Everything else on screen looked genuine.

The macOS chain: AMOS and wallet swapping

On macOS, the command installs Atomic macOS Stealer (AMOS), an AppleScript-based infostealer. Once it runs, it:

• Displays a fake "Full Disk Access required" prompt and relaunches itself until it gets the permission.
• Shows a fake macOS password dialog that keeps reappearing until the victim types their real password.
• Harvests saved passwords, browser logins and sessions, Keychain data, notes and documents (.pdf, .docx, .key, .seed, .pem, .wallet and .ovpn files among them) and uploads them to the operator's server.
• If Ledger Live, Ledger Wallet or Trezor Suite is installed, silently swaps it for a trojanized copy. The next time the victim opens the wallet, the fake app asks for the recovery phrase and sends it to the attacker.

The Windows chain

A parallel Artifact titled "Install Claude on Windows" told users to press Win + R, then Ctrl + V, then Enter. The pasted PowerShell command was malicious from the first character and printed fake "verification" messages while it ran. It fetched a second stage from GitHub and a github.io page, which delivered an encrypted .NET payload.

That final component hides inside a legitimate Windows process, checks for antivirus products, captures desktop screenshots, keeps a connection open so the operator can issue further commands, and hunts for Electrum, Exodus, Ethereum, Bitcoin and Ledger wallet data.

Why it matters

Most anti-phishing advice rests on small tells: a misspelled domain, a missing padlock, an unfamiliar brand. This campaign removed all of them. The domain is real, the certificate is real and the logo is real. The only honest signal was a small "user-generated" label that most people never read.

It also shows how quickly attackers follow user demand. AI assistants are being installed on company laptops at scale, often by employees searching "download Claude" without going through IT. A sponsored result at the top of that search is a cheap, effective entry point into both personal crypto wallets and corporate credentials.

It is worth being precise about what was and was not compromised. Anthropic's infrastructure was not breached. The abuse lies in how publicly shareable content on a trusted domain can be dressed up as something official, and the same pattern applies to any platform that hosts user-generated pages.

Indicators to watch

Indicators are defanged on purpose. Re-fang them only inside controlled tooling such as your SIEM or threat-intel platform.

What to do

• Never paste a command into Terminal, PowerShell or the Run dialog that you did not write yourself, regardless of which site is asking.
• Reach software download pages by typing the vendor's address or using a bookmark, not through sponsored search results. Anthropic's genuine desktop apps are distributed from its official download page, not from a shared chat.
• Treat any "user-generated" or "unverified" label on a page as a stop sign, especially when the page asks you to install something.
• Never enter a wallet recovery phrase into software that asks for it unexpectedly. Legitimate wallet apps do not request it during routine use.
• If you already ran one of these commands, assume the device is fully compromised. From a clean machine, change important passwords, revoke active sessions, enable multi-factor authentication, and move crypto funds to a wallet created from a brand-new recovery phrase.
• For organizations: block Run-dialog and Terminal ClickFix patterns with EDR rules, restrict PowerShell for standard users, and hunt proxy logs for claude.ai share and artifact URLs carrying gclid or gad_campaignid parameters.

Infostealer logs like the ones AMOS produces typically surface on criminal marketplaces within days of a successful infection, and the corporate credentials inside them are often what triggers the next breach. 4tify's Deep/Dark Web monitoring watches those channels for your domains and employee accounts, so a stolen session or password can be rotated before it is used against you.