Cybercriminals found a simple way to make a fake download page look trustworthy. Instead of registering a lookalike domain, they placed their lure on claude.ai, the official website of Anthropic, the company behind the Claude AI assistant.

The fake page carried Claude branding and offered what looked like easy steps to install a desktop app. The attackers also paid for Google Ads so these pages appeared near the top of search results.

Anthropic never published these instructions, and the page had no installer. It told visitors to copy a command and paste it into Terminal on their Mac.

Anyone who followed the steps installed Atomic macOS Stealer, known as AMOS, a program built to steal passwords, browser sessions, cryptocurrency wallets, and other sensitive data.

The malware can also replace the real Ledger and Trezor desktop apps with modified copies that ask for the wallet recovery phrase.

Researchers at Gen Digital, including threat analysis engineer Vojtěch Moravec, identified these campaigns and described them in a Gen Digital’s full research report published on October 26, 2026.

Gen’s team also found a second campaign that used the same method against Windows users, with different instructions and a different final payload. This shows the threat is not limited to one operating system.

Hackers Abuse Claude’s Official Website and Google Ads

Most phishing relies on small clues, such as a misspelled domain or a missing padlock. This campaign removed those clues. The fake “Download Claude” pages were user-generated content on claude.ai, delivered as either a Shared Chat or a public Artifact.

Both are normal Claude sharing features. Claude shows a thin banner saying the content is user-generated and unverified, but the domain, padlock, and logo all look genuine.

The malicious links carried Google Ads tracking parameters such as gclid and gad_campaignid, which confirms the attackers paid to promote them.

Researchers also found several rotating Artifacts tied to two ad campaigns, so this was a funded, ongoing operation rather than a single case.

MALICIOUS — the fake “Download Claude” page hosted as a claude.ai Artifact (Source - GenDigital) — MALICIOUS — the fake “Download Claude” page hosted as a claude.ai Artifact (Source – GenDigital)

Cyber Security News reported on similar lures earlier in the year, in its coverage of fake Claude installer pages that also used sponsored search results.

The lure depends on a technique called ClickFix, which asks the victim to run a command personally. The page shows a box titled “Install on macOS” with four steps: open Terminal, click Copy, paste, and press Enter.

The copied command is scrambled, so the visitor sees only gibberish instead of a suspicious web address. Because the user runs it, many built-in defenses do not stop it. Earlier reports, including past ClickFix technique research, show how widely this pattern has spread.

Windows Campaign, Wallet Theft, and Protection Tips

The Windows version used an Artifact titled “Install Claude on Windows,” which told users to press Win + R, then Ctrl + V, then Enter. The pasted PowerShell command was malicious from its first character and displayed fake “verification” messages while it ran.

It then reached GitHub and a github.io page to fetch the next stage, which carried an encrypted .NET payload.

The whole attack, step by step (Source - GenDigital) — The whole attack, step by step (Source – GenDigital)

That final program hides inside a normal Windows process, checks for antivirus software, takes desktop screenshots, and keeps a connection open so the operator can send more commands. It also searches for Electrum, Exodus, Ethereum, Bitcoin, and Ledger wallets.

Stealers like AMOS are not new on Macs either. A recent AMOS malext malvertising campaign showed the same pattern, with paid ads pushing macOS users toward terminal commands and trojanized Ledger and Trezor apps.

Gen’s advice is clear. Never paste a command you did not write yourself, and type the vendor’s address or use a bookmark. Anthropic’s real download page is claude.com/download.

Treat the “user-generated” label as a warning sign, and never enter a recovery phrase into software that asks for it unexpectedly.

Anyone who already ran one of these commands should assume the device is fully compromised. From a clean device, change important passwords, log out of all sessions, enable multi-factor authentication, and move crypto funds into a wallet created from a new recovery phrase.

Indicators of compromise (IoCs):-

Type	Indicator	Description
Domain	claude[.]ai	Anthropic’s real domain abused to host fake Artifact and Shared Chat pages
URL path	claude[.]ai/share/…	Shared Chat route used to deliver the fake “Claude Code on Mac” lure
URL path	claude[.]ai/artifact/…	Public Artifact route hosting fake “Download Claude” and “Install Claude on Windows” pages
URL parameters	gclid, gad_campaignid	Google Ads tracking parameters found in malicious links
Domain	github.io	Trusted-looking host for the next Windows stage
Lure	Terminal command (macOS)	ClickFix command copied to clipboard through the “Install on macOS” box
Lure	Win + R, Ctrl + V, Enter	ClickFix sequence that runs a malicious PowerShell command on Windows
Malware	Atomic macOS Stealer (AMOS)	AppleScript-based macOS infostealer
Malware	Trojanized Ledger Live, Ledger Wallet, Trezor Suite	Fake wallet apps that ask for the recovery phrase
Malware	Obfuscated .NET executable	Final Windows payload with remote-access behavior
File types	.pdf, .docx, .key, .seed, .pem, .wallet, .ovpn	Files the macOS stealer searches for and steals

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Abuse Claude’s Official Website and Google Ads to Spread Malware appeared first on Cyber Security News.