Overview: Bing Malvertising Delivers SectopRAT Malware via Fake Claude App
Runtime Rebel analysts have identified a concerning malvertising campaign actively leveraging Bing Search to distribute the potent SectopRAT malware. This campaign specifically targets users searching for a desktop version of the popular Claude AI application. Attackers are running deceptive advertisements that, when clicked, redirect unsuspecting users to a fake Claude website. This fraudulent site then hosts a malicious installer masquerading as a legitimate Claude desktop application, ultimately leading to a SectopRAT infection.
This sophisticated operation highlights the increasing threat of malvertising and the exploitation of popular software demand. The campaign was initially reported by Group-IB, shedding light on the full chain of compromise, according to BleepingComputer. Security professionals should be aware of these Claude AI fake app threats on Bing and educate end-users on safe software acquisition practices.
Technical Analysis: SectopRAT Capabilities and Persistence Mechanisms
The attack chain begins with sponsored search results on Bing for terms like “Claude AI” or “Claude desktop app.” Clicking these malicious advertisements initiates a series of redirects, eventually landing the victim on a fake website, identified as claude-desktop[.]com, which impersonates the legitimate Claude AI platform. This deceptive site offers a supposed desktop application for download, which is, in fact, the SectopRAT malware installer.
SectopRAT is a formidable remote access Trojan (RAT) known for its extensive capabilities, allowing threat actors significant control over compromised systems. Its functionalities include:
- Remote Code Execution (RCE): Full command and control over the infected machine, enabling attackers to execute arbitrary code.
- Keylogging: Capturing keystrokes, leading to the theft of credentials, personal information, and sensitive data.
- Screenshot Capture: Periodically taking screenshots of the desktop, providing visual access to user activity.
- File Exfiltration: Locating and stealing documents, databases, and other valuable files from the victim’s system.
- System Information Gathering: Collecting detailed information about the operating system, hardware, and installed software.
One of the critical aspects of this TTP is the establishment of persistence. SectopRAT achieves this by creating a scheduled task named ClaudeAppUpdaterTask. This task ensures the malware relaunches even after system reboots, maintaining a persistent foothold on the compromised device. This method allows for continued access and data theft, making it difficult for standard antivirus solutions to fully remediate without manual intervention or advanced EDR capabilities.
Typical indicators of compromise (IoC) associated with this specific campaign and SectopRAT include the presence of Claude.exe running from non-standard locations such as %APPDATA%\Claude or C:\Program Files\Claude, which would not be the case for a legitimate application.
Actionable Recommendations: Mitigating and Detecting SectopRAT Malware Infections
Organisations must implement robust security measures and educate their workforce to counter such sophisticated phishing and malvertising tactics. Prioritising these actions is crucial for protecting against SectopRAT and similar threats:
- Strict Software Sourcing: Mandate that all software, especially new applications, be downloaded exclusively from official vendor websites or trusted enterprise software repositories. Never rely on search engine advertisements, even those appearing to be official, for critical software downloads.
- Utilise Ad Blockers: Implement browser-level ad blockers or network-level DNS filtering to minimise exposure to malicious advertisements on search engines and other websites.
- Enhanced Endpoint Protection: Deploy and maintain up-to-date EDR solutions capable of behavioural analysis to detect unusual process activity, such as
Claude.exelaunching from unexpected directories or creating scheduled tasks for persistence. These tools are vital for detecting SectopRAT malware infections that bypass traditional signature-based detection. - User Awareness Training: Conduct regular security awareness training, focusing on the dangers of malvertising, social engineering, and the importance of verifying URLs before clicking and downloads before executing.
- Network Traffic Monitoring: Monitor network traffic for suspicious C2 communications or data exfiltration attempts. SIEM systems can correlate logs to identify anomalous activity indicative of a SectopRAT infection.
- Regular Backups: Maintain offline, immutable backups of critical data to ensure business continuity in the event of a successful compromise leading to data corruption or exfiltration.