Bing malvertising impersonates Claude to deliver SectopRAT malware

A Bing search malvertising campaign promoted a fake Claude desktop installer hosted on Claude.ai to deliver the SectopRAT information-stealer/HVNC malware, compromising at least 29 organizations on July 21–22. The fake ClaudeDesktop.exe loader hijacks a legitimate JetBrains Chromium component to load a malicious DLL, with persistence via a DockerDesktop.exe‑spawned scheduled task and multiple anti‑analysis checks. SectopRAT, active since 2019, exfiltrates credentials and supports remote control; the campaign also leveraged Claude Opus 4.8 for analysis. Researchers found about 10 domains tied to the same email since December 2025, but there isn’t enough evidence to link FakeAgent to a known threat group. The advisory advises downloading software only from official sources and avoiding sponsored results.