Claude.ai and Google Ads abused to spread malware

Key Takeaways

• Threat actors leveraged Anthropic’s official Claude.ai platform and Google Ads to distribute malware, including the Atomic macOS Stealer (AMOS) and a sophisticated Windows infostealer.
• The attack exploited Claude’s user-generated content features (Shared Chats and Artifacts) to host malicious download pages, bypassing typical domain-based phishing indicators.
• Victims were tricked into executing commands via their operating system’s terminal, a technique known as ClickFix, leading to the compromise of sensitive data, including cryptocurrency wallets.
• Both macOS and Windows users were targeted in separate, ongoing campaigns.
• Immediate action is required for anyone who executed these commands, including password changes, MFA enablement, and securing cryptocurrency assets.

Sophisticated Malware Campaigns Exploit Claude.ai and Google Ads

Cybercriminals have devised an ingenious method to lend credibility to fake download pages, circumventing the need for lookalike domains. They achieved this by hosting their malicious lures directly on claude.ai, the legitimate website of Anthropic, the creators of the Claude AI assistant. This tactic allowed them to exploit the trust associated with an official vendor domain.

These deceptive pages mimicked Claude’s branding, presenting seemingly straightforward instructions for installing a desktop application. To maximize reach, the attackers utilized Google Ads, ensuring their malicious pages appeared prominently in search engine results, often at the top.

Anthropic never officially released a desktop application, rendering these instructions illegitimate. The pages did not offer a direct installer; instead, they instructed visitors to copy a command and paste it into their Mac’s Terminal application. Users who followed these instructions inadvertently installed the Atomic macOS Stealer (AMOS), a potent malware designed to exfiltrate passwords, browser session data, cryptocurrency wallets, and other confidential information.

Beyond data theft, AMOS is capable of replacing genuine Ledger and Trezor desktop applications with compromised versions that prompt users for their wallet recovery phrases. Researchers at Gen Digital, including threat analysis engineer Vojtěch Moravec, identified these sophisticated campaigns. Their comprehensive findings were detailed in a Gen Digital research report published on October 26, 2026. The Gen Digital team also uncovered a parallel campaign targeting Windows users, employing similar techniques but with different instructions and a distinct final payload, indicating a broad, multi-platform threat.

Abusing Official Platforms and Paid Promotion

Traditional phishing attacks often rely on subtle indicators like misspelled domains or the absence of a secure padlock icon. This campaign skillfully eliminated such tell-tale signs. The fraudulent “Download Claude” pages were embedded as user-generated content on claude.ai, presented either as a “Shared Chat” or a “public Artifact.”

These are standard content-sharing functionalities within Claude. While Claude displays a subtle banner indicating the content is user-generated and unverified, the primary domain, security padlock, and brand logo all appear authentic, lending a strong sense of legitimacy to the malicious content. This design choice significantly enhances the attack’s effectiveness.

Analysis of the malicious links revealed Google Ads tracking parameters, specifically “gclid” and “gad_campaignid,” confirming that the attackers invested in paid advertising to promote their fraudulent content. Researchers observed multiple rotating Artifacts linked to at least two distinct ad campaigns, suggesting a well-funded, persistent operation rather than an isolated incident.

This attack vector echoes previous reports of fake Claude installer pages that also leveraged sponsored search results. The core of the lure relies on a technique known as “ClickFix,” which manipulates victims into personally executing a command. The malicious page features an “Install on macOS” box with four steps: open Terminal, click Copy, paste the command, and press Enter. The command itself is deliberately obfuscated, appearing as gibberish to the user, thereby concealing its malicious nature. Because the user explicitly executes the command, many built-in operating system defenses are circumvented. Prior research into the ClickFix technique has highlighted its widespread adoption by threat actors.

Windows Campaign, Wallet Theft, and Mitigation

The Windows variant of the campaign utilized an Artifact titled “Install Claude on Windows.” This page instructed users to press Win + R, then Ctrl + V, followed by Enter. The pasted PowerShell command was immediately malicious, displaying fabricated “verification” messages while executing. Subsequently, it contacted GitHub and a github.io page to retrieve the next stage of the attack, which delivered an encrypted .NET payload.

This final Windows malware payload operates stealthily within a normal Windows process, performs checks for antivirus software, captures desktop screenshots, and maintains a persistent connection to its command-and-control server, allowing operators to issue further commands. It also actively scans for and targets various cryptocurrency wallets, including Electrum, Exodus, Ethereum, Bitcoin, and Ledger wallets. The sophisticated nature of this payload underscores the severity of the threat.

Mac users are not unfamiliar with infostealers like AMOS. A recent malvertising campaign involving AMOS exhibited a similar modus operandi, employing paid advertisements to direct macOS users toward executing terminal commands and installing trojanized Ledger and Trezor applications.

What You Should Do

• Never Paste Unknown Commands: Absolutely avoid copying and pasting commands into your terminal or command prompt unless you fully understand their function and trust the source implicitly.
• Verify Download Sources: Always navigate directly to a vendor’s official website by typing the URL (e.g., claude.com/download) or using a trusted bookmark. Never rely on search engine results, especially sponsored ones, for software downloads.
• Heed User-Generated Content Warnings: Treat any “user-generated” or “unverified” labels on web content as significant warning signs, regardless of the domain’s apparent legitimacy.
• Protect Cryptocurrency Wallets: Never enter a cryptocurrency wallet recovery phrase into any software that unexpectedly requests it. Legitimate hardware wallet applications will rarely, if ever, ask for your recovery phrase directly within the software.
• Assume Compromise if Commands Were Executed: If you have executed any of these malicious commands, assume your device is fully compromised. Immediately take the following steps from a clean, uncompromised device:
  • Change all critical passwords (email, banking, social media, etc.).
  • Log out of all active sessions across all services.
  • Enable multi-factor authentication (MFA) on all accounts where available.
  • For cryptocurrency, move all funds to a new wallet generated with a fresh recovery phrase.
  • Perform a full system scan with reputable antivirus software and consider a complete operating system reinstall.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.