How Criminals Abuse Claude’s Own Website to Spread Malware

We found a fake “Download Claude” page, and one thing about it was unusual: the web address was real. The page was hosted on claude.ai, which is Anthropic’s own domain. It had Claude’s branding and what looked like simple instructions to install the desktop application. The attackers even paid for Google ads to send people there.

Anthropic, of course, never published such instructions. The attackers used Claude’s features for sharing conversations and Artifacts, and through them they placed malicious content on the real website. The page did not offer any installer. Instead, it told visitors to copy a command and paste it into the Terminal on their Mac. Everybody who followed these steps installed Atomic macOS Stealer (AMOS) — a malware that is made to steal passwords, browser sessions, cryptocurrency wallets and other sensitive data.

Our analysis found one more unpleasant thing. The malware can also replace the legitimate Ledger and Trezor desktop applications with modified versions. Later these fake versions ask the user to type the wallet recovery phrase, and this gives the attackers everything they need to take the victim’s cryptocurrency.

And this wasn't limited to macOS. We identified another campaign using Claude's sharing features and Google Ads to target Windows users. The installation instructions were different, as was the malware being delivered, but the approach was essentially the same.

Neither campaign required compromising Anthropic's infrastructure or registering a convincing imitation of its domain. The attackers simply took advantage of features available to ordinary Claude users, turning legitimate content-sharing functionality into a way to distribute malware.

When the scam lives on the real domain

Most phishing and scam campaigns depend on small details that the visitor is supposed to not notice — a domain name with a typo, a strange top-level domain, a missing padlock.

This campaign removes all of that. The fake “Download Claude” page is real user-generated content hosted on claude.ai, and it is served in two ways: as a Shared Chat (claude[.]ai/share/…) and as a public Artifact (claude[.]ai/artifact/…). Both of them are normal Claude features for sharing content.

MALICIOUS — the fake “Download Claude” page hosted as a claude.ai Artifact

LEGITIMATE — the real download page at claude.com/download

The platform marks the content correctly as unverified, but the domain still looks very trustworthy. On the Artifact page the only warning is a thin banner with the text “Content is user-generated and unverified.” Everything else — the domain, the padlock, the branding — looks genuine, and the attackers count exactly on this.

Scam at the very top

You do not find these pages by accident. The links we analyzed contained Google Ads tracking parameters (gclid, gad_campaignid). This means the attackers paid for advertising to push their malicious pages to the top of the search results — a technique that is called malvertising. In the same cluster we found several different Artifacts connected to two different ad campaigns, so this was a funded and rotating operation, not a single case.

The same payload was delivered also through a Shared Chat — a fake “Claude Code on Mac” conversation. Claude puts even a disclaimer on it (“Content may include unverified or unsafe content that does not represent the views of Anthropic”), but the lure is placed right under it.

The lesson for users is unpleasant but simple: the first search result, and especially a sponsored one, is not a sign of safety. Attackers can buy their way to the top, and they do it.

The command you paste yourself

Here the attack becomes clever. The fake page does not really give you an application to download. Instead it shows a nice box called “Install on macOS — Quick install via Terminal” and takes you through four friendly steps: open Terminal, click a Copy button, paste, and press Enter.

This family of tricks is called ClickFix, and even though it has been here for a while, it remains popular with attackers as it avoids many defenses in a simple way:

• Nothing suspicious is really “downloaded.” You copy some text and you run it yourself.
• You are the one who runs it. The command starts a chain of scripts that are downloaded from the attacker’s server, but for the operating system it looks like you typed it.
• The command is scrambled on purpose. What you get on your clipboard is an obfuscated one-liner that hides the attacker’s address inside an encoded blob. So even a curious user sees only gibberish and not a suspicious URL.

The most useful habit you can build is one: never paste into your Terminal a command that you did not write yourself. No legitimate application — not Claude and not anything else — needs you to run a cryptic one-liner to be installed.

The theft begins

The moment you paste the command into your Terminal and press Enter, a chain of several stages runs completely in the background:

• A loader script is downloaded from the attacker’s server and it unpacks a second script.
• This second script downloads the main payload — an AppleScript-based infostealer from the Atomic macOS Stealer (AMOS) family — and runs it.
• The stealer starts its work.

Before the stealer can take anything, it needs Full Disk Access. If it does not have this access, it does not start to steal. Instead it shows a fake macOS “Full Disk Access required” message and quietly adds a line to the shell startup file, so the malware starts again the next time you open the Terminal. In this way it simply waits until it gets the access it needs. Once it has the access, the stealer shows a familiar dialog: a fake macOS “System Preferences” password prompt. It looks native and it does not go away until you type a password that really works. After you type it, the malware has your login password in cleartext, and it keeps it.

After this it harvests, fast and quietly: Passwords and session cookies from Chromium and Gecko based browsers along with Keychain keys it needs to decrypt saved logins, crypto wallets both browser-extension and desktop applications and also files that usually hold secrets, private or otherwise interesting data such as with .pdf, .docx, .key, .seed or .pem, .wallet, or .ovpn extensions.

All the collected data is packed into a ZIP file and uploaded to the attacker’s server. After the upload the stealer deletes its temporary files, so it leaves less trace behind.

Fake wallet apps

When the stealer sees that Ledger Live, Ledger Wallet, or Trezor Suite is installed, it downloads a trojanized copy of this application from the attacker and puts it over the real one. The modified application looks and works like a normal one.

The trap activates later. The next time when you open your wallet, a convincing screen asks you to “restore” or “validate” your recovery phrase (for Trezor it even shows a fake progress animation: “Reading device info… Validating seed phrase… Almost there”). The words that you type go directly to a second attacker server — a different domain than the one which delivered the malware, and it is built only to collect seed phrases.

Those words are your money. Anybody who has them can empty every wallet that is derived from them, immediately and without any way back. 

The same trick comes to Windows

We also identified a separate campaign targeting Windows users. But the method does not really care about the operating system, and we found a second campaign on claude.ai that works in exactly the same way — only the victim and the final malware are different.

The lure is again a page that lives on the real domain. This time it is an Artifact with the title “Install Claude on Windows”, and it is pushed in the same way: the link carries Google Ads parameters (gclid, gad_campaignid), so the attackers again paid to place it high in the search results. The page shows the Claude logo, a friendly “Three quick steps and you’re done”, and the same thin “Content is user-generated and unverified” banner on the top that almost nobody reads.

What changes is the ClickFix itself. On the Mac the victim is sent to the Terminal. On Windows the page asks you to press Win + R (this opens the Run dialog), then Ctrl + V to paste, and Enter to run. No Terminal, no file to download — only three keys, and the attack starts.

What you paste is a PowerShell command, and it is malicious from the first character — there is no installer in it at all. To look harmless while it runs, it first prints a big “SYSTEM” banner and calm messages like “Challenge in progress, this won’t take long… 50% done… 70% done… Challenge completed.” For the victim it looks like a normal verification step. 

That script reaches out to GitHub. The attackers put their next stage on a github.io page, so once more a trusted name carries the malware. The file downloaded looks like an ordinary script, but inside it carries the  .NET payload, packed and encrypted. 

The final payload

The final payload is a heavily obfuscated .NET executable. 

The behavior however, is clear enough. The malware hides itself by injecting its code into a normal Windows process, so in the task list nothing looks wrong. It checks which antivirus is present, it takes screenshots of the desktop, and it reads the title of the window where the user is working. It also opens a connection to a server of the attacker and keeps it — which means the operator can send more commands later. This is the behavior of a remote-access tool, not of a simple program that steals once and goes away.

And it goes after cryptocurrency. The malware searches the infected computer for crypto wallets — desktop applications like Electrum, Exodus, Ethereum, Bitcoin and Ledger, and also wallet extensions inside the browser.

Two campaigns, two operating systems, two different pieces of malware — but one and the same front door: a page on claude.ai that looks official, pushed by paid ads, asking the user to run a single command they did not write.

Why this goes beyond Claude

Attackers have been abusing legitimate websites to distribute malware for years. What makes this case interesting is how easily Claude's sharing features could be used to create something that looked like an official software download page, without compromising Anthropic's infrastructure.

Claude is unlikely to be the last AI service targeted this way. As more platforms allow users to publish and share content, attackers have more opportunities to exploit the reputation of those services. The challenge for platform operators is finding ways to prevent that abuse without making legitimate sharing unnecessarily difficult.

For users, the distinction is worth remembering. A genuine website address tells you where content is hosted, but it doesn't necessarily tell you who created it or whether you should trust it.

How to protect yourself

• Never paste into Terminal (or PowerShell) a command that you did not write yourself. This one habit defeats the whole ClickFix family. 
• Download software from the main site of the vendor — and type the address yourself or use a bookmark. The real download page of Claude is claude.com/download. Do not trust the search results, and be extra careful with sponsored ads.
• Treat the “user-generated / unverified” labels as a stop sign. If a “download” or “install” page lives on a sharing or artifact URL and not on the own product site of the company, leave it.
• Never type your wallet recovery phrase into software that asks for it unexpectedly. The seed entry happens on the hardware device. A “restore/validate your phrase” prompt inside the app is theft.
• Keep a reputable security software turned on. It blocks the known command-and-control servers and detects this behaviour.
• If you think that you already ran something like this, expect a full compromise. From a different, clean device, change every important password (email, banking and crypto exchanges first), log out from all sessions, and turn on multi-factor authentication. For crypto, move the funds to a wallet that is created from a completely new recovery phrase, and reinstall the wallet applications only from the official vendor.