Gen Digital found a fake “Download Claude” page hosted on claude.ai, Anthropic’s own domain. The branding was Claude’s, the padlock was real, and the domain had no typo to spot. The page posed as an official download page, but its install instructions were the trap, and following them installed malware.
Gen Digital’s report, published 26 October 2026, describes two campaigns in one cluster: one aimed at Mac users, one at Windows users, both promoted through paid Google Ads. The links carried Google Ads tracking parameters (gclid, gad_campaignid), which Gen Digital reads as evidence the attackers paid to promote the pages. Gen Digital also found several rotating Artifacts tied to two ad campaigns, which it describes as a funded, rotating operation rather than a single case.
Two surfaces, two operating systems
Our analysis of Gen Digital’s findings arranges the cluster as a simple matrix: two delivery surfaces, Shared Chats and public Artifacts, both normal Claude sharing features, and two operating-system campaigns, each ending in different malware.
| Campaign | Delivery surface | Final payload |
|---|---|---|
| macOS | Shared Chat and public Artifact | Atomic macOS Stealer (AMOS) plus trojanized Ledger and Trezor apps |
| Windows | Public Artifact | Encrypted, obfuscated .NET remote-access payload via a github.io page |
The pages did carry warnings. The Artifact carried only a thin banner reading “Content is user-generated and unverified”. The Shared Chat carried a disclaimer that content may include unverified or unsafe content and does not represent Anthropic’s views. Everything else, domain, padlock, branding, looked genuine.
How the Mac trap worked
The Mac page showed a box titled “Install on macOS” with four steps: open Terminal, click Copy, paste, press Enter. The copied command was obfuscated, so the visitor saw gibberish rather than a suspicious address. This is the ClickFix technique: the victim runs the command personally, so the system treats it as typed input.
Following the steps installed Atomic macOS Stealer, an AppleScript-based infostealer built to steal passwords, browser sessions, cryptocurrency wallet data, and other sensitive data. If Full Disk Access was missing, the stealer showed a fake macOS “Full Disk Access required” message and added a line to the shell startup file for the next Terminal opening. Once it had access, it showed a fake macOS “System Preferences” password prompt that stayed until a working password was typed, giving the malware the login password in cleartext.
The harvest covered passwords and session cookies from Chromium- and Gecko-based browsers, Keychain keys needed to decrypt saved logins, browser-extension and desktop crypto wallets, and seven secret-bearing file extensions Gen Digital lists by name (.pdf, .docx, .key, .seed, .pem, .wallet, .ovpn). Collected data was packed into a ZIP file, uploaded to the attacker’s server, and temporary files deleted.
The wallet trap came later. When Ledger Live, Ledger Wallet, or Trezor Suite was installed, the stealer replaced it with a trojanized copy that later asked the user to “restore” or “validate” the recovery phrase, with Trezor showing a fake progress animation. Typed words went to a second attacker server built only to collect seed phrases.
The Windows version ran on three keyboard steps
The second campaign used a claude.ai Artifact titled “Install Claude on Windows”, pushed the same way via Google Ads parameters. It told users to press Win + R, then Ctrl + V, then Enter. No Terminal, no file to download, only three keyboard steps.
The pasted PowerShell command was malicious from its first character and displayed fake “verification” messages while running. It reached GitHub and a github.io page to fetch the next stage: a .NET payload, packed and encrypted for delivery, whose heavily obfuscated final executable injected into a normal Windows process, checked for antivirus software, took desktop screenshots, read the active window title, and kept a connection open for further commands. It searched for five crypto targets Gen Digital names: Electrum, Exodus, Ethereum, Bitcoin, and Ledger.
What is still not known
Gen Digital gives no victim count, infection count, ad-impression count, or financial-loss figure, and neither does CybersecurityNews. No attacker identity or group name is given. Whether any specific person lost cryptocurrency, or how much, is not reported. Whether the campaigns are still live, or were already taken down before Gen Digital’s 26 October publication, is not stated. No Anthropic or Google statement on these campaigns appeared in our 29 October search of the coverage.
Gen Digital says neither campaign required compromising Anthropic’s infrastructure or registering an imitation domain: the attackers used features available to ordinary Claude users. This is abuse of sharing features in these campaigns, not a compromise of Anthropic’s infrastructure.
What should I do if I ran one of these install commands?
Assume full compromise. Gen Digital’s advice is blunt: treat the machine as fully compromised, work from a clean device, change your important passwords, log out of all sessions, enable multi-factor authentication, and move crypto funds to a wallet created from a new recovery phrase.
- Change every important password from a clean device, starting with email, banking, and crypto exchanges.
- Log out of every session on every service, as Gen Digital recommends for compromised accounts.
- Turn on multi-factor authentication on every account that offers it, starting with email and banking.
- Move crypto funds to a wallet created from a completely new recovery phrase you have never typed anywhere.
- Reinstall wallet applications only from the official vendor, never from a link in search results.
For future downloads, the real Claude download page is claude.com/download: type the address yourself or use a bookmark, and treat any “download” page on a sharing or artifact URL as a stop sign.
What to watch next
Three things would change this story: an Anthropic or Google statement on removal of the pages or ads, a victim or infection count, and confirmation of whether the campaigns are still live. Until one appears, the scale stays unmeasured.
Not connected to earlier Claude stories
Earlier Claude ClickFix campaigns are separate from this cluster: the BleepingComputer report on Claude artifacts pushing Mac infostealers, the Push Security “Adception” campaign that used a fake domain, not claude.ai hosting, the Claude Mythos 5 evaluation, and the Cathedral internal-systems test. None of them confirms or extends the Gen Digital findings above.
Sources
- Gen Digital, “How Criminals Abuse Claude’s Own Website to Spread Malware”, gendigital.com, 26 October 2026.
- CybersecurityNews, “Hackers Abuse Claude’s Official Website and Google Ads to Spread Malware”, cybersecuritynews.com, 27 October 2026 (restates Gen Digital’s report).
