Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware

Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware.

The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine.

For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems.

The attack begins with malicious search advertisements that steer victims toward convincing public artifact pages. After a user downloads and runs the supposed installer, the infection moves quickly through several stages.

The final payload is SectopRAT, a remote-access tool that can steal information and give attackers hidden control of an infected device. Such access can let criminals collect files, watch activity, or return later with further instructions.

CyberProof said in a report shared with Cyber Security News (CSN). Its analysts noted that the activity matches the FakeAgent campaign previously tracked in the wild, where attackers abuse public hosting and spoofed installers to deliver malware.

The incident was identified from an alert involving a scheduled task designed to look like a normal software update. Analysts then correlated evidence across the affected endpoint instead of treating that signal as a standalone event.

The case underlines a wider problem for businesses and home users alike. A familiar name is often enough to lower a victim’s guard, particularly when an advertisement appears above legitimate search results.

Recent reporting on fake Gemini installer attacks shows that criminals are also exploiting other popular AI brands to push credential-stealing malware.

Hackers Use Fake Claude Desktop App

Once the victim launched the counterfeit application, it used PowerShell to add exclusions for folders in the user profile, reducing Microsoft Defender visibility over the area where malicious files were staged.

The initial loader then used DLL sideloading, a method that makes a legitimate program load a harmful supporting file. This allowed the code to run in the context of a signed Java Chromium Embedded Framework helper.

The mismatch between the displayed application name and the program’s internal details was a valuable warning sign.

The malware also created a logon-triggered task with elevated privileges while disguising it as a browser updater. That task called a second loader from a user-writable roaming folder, allowing the infection to return after a reboot.

Abuse of native scheduling features remains a proven way to retain access, as shown in reports on Windows scheduled task abuse.

CyberProof’s investigation found that the operators avoided a conventional command server. Instead, the malware relied on EtherHiding, retrieving encrypted connection details from Ethereum blockchain data.

That approach can make takedowns harder because the attacker can rotate infrastructure without relying on one fixed domain or server.

Containment Needs Full Response

Researchers stressed that removing a visible task or one malicious file is not enough when remote-access malware has executed.

In the observed incident, responders isolated the device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to check whether stolen credentials had been used elsewhere.

Defenders should investigate newly created high-privilege tasks that launch software from Downloads, AppData, or other user-controlled locations.

They should also flag new antivirus exclusions made soon after a download and inspect unexpected library loads outside normal program folders. Similar chains that combine spoofed software and library loading have appeared in AsyncRAT fake installer campaigns.

Organizations can reduce exposure by directing staff to approved software channels and restricting local installation rights where practical. Search advertisements for developer and AI tools deserve extra caution, even when the landing page looks legitimate.

Monitoring browser-originated downloads, scheduler changes, security-setting changes, and blockchain RPC traffic together can help teams recognize the full attack rather than treating each alert as an isolated event.

That broader view is important when attackers intentionally spread their activity across several ordinary Windows features.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
File name	ClaudeDesktop.exe	Initial trojanized loader
File metadata	JCEF Helper / jcef_helper.exe	Internal metadata associated with the fake loader
File name	DockerDesktop.exe	Staged loader used for reboot persistence
File name	libcef.dll	VMProtect-packed DLL used in the sideloading chain
File name	tempdir.dll	DLL name included in the hunting logic for suspicious sideloading activity
File name	Claude.exe	Suspicious installer-related file name included in hunting logic
File name	ClaudeSetup.exe	Suspicious installer-related file name included in hunting logic
File name	Docker Desktop.exe	Suspicious installer-related file name included in hunting logic
File path	AppData\Roaming\EdgeUpdate-1b4adb1f\	User-writable staging directory
Scheduled task	MicrosoftEdgeUpdate	Disguised logon persistence task configured with elevated privileges
Domain	downloading-api.it.com	Malvertising download infrastructure
Domain	neeitoerw[.]my	Suspicious domain observed in the process lineage
IP address	153.75.84.173	Network infrastructure observed in the process lineage
URL pattern	claude[.]ai/public/artifacts/[id]	Masqueraded lure artifact page
URL / domain	download-app.us	Suspicious origin included in hunting logic
URL / domain	claude-desktop.gitlab.io	Suspicious origin included in hunting logic
URL / domain	claude.ai.download-app.us	Suspicious origin included in hunting logic
URL path	it.com/html/claude/win	Suspicious origin included in hunting logic
Domain	claude-code-cmd.squarespace.com	Suspicious origin included in hunting logic
URL path	code.claude.ai/download	Suspicious origin included in hunting logic
Domain	install-files.com	Suspicious origin included in hunting logic
Keyword	claude-code	Suspicious origin keyword included in hunting logic
Keyword	claude-desktop	Suspicious origin keyword included in hunting logic
SHA-256	f8acb8f5...	Partial hash of the initial payload, as published in the source report

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC