Attackers used Claude pages and Google Ads to spread malware

The pages were hosted on claude.ai, Anthropic’s own domain, and attackers used Claude’s conversation-sharing and Artifact features to put malicious content there.[1] Shared Chats and public Artifacts are ordinary Claude features for sharing content.[1] The fake pages used Claude branding and appeared to offer simple desktop-app installation instructions, but Anthropic did not publish those instructions.[1] Attackers paid for Google ads to send users to the pages, and the ads could place them near the top of search results.[1][2]

The fake Mac page did not offer an installer; it told visitors to paste a command into Terminal.[1] Gen Digital’s report says everybody who followed the steps installed Atomic macOS Stealer, or AMOS.[1] The malware is designed to steal passwords, browser sessions, cryptocurrency wallets and other sensitive data.[1] It can also replace legitimate Ledger and Trezor desktop apps with modified versions.[1] Those modified apps ask users for their recovery phrase, giving attackers what they need to take victims’ cryptocurrency.[1]

Researchers also identified a campaign that used Claude’s sharing features and Google Ads to target Windows users.[1] It used different installation instructions and different malware from the Mac campaign.[1] The available evidence does not identify the Windows malware or describe its installation steps, so the Mac instructions and AMOS should not be assumed to apply to Windows.[1] Researchers found several rotating Artifacts associated with two ad campaigns and described the operation as ongoing and funded.[2]

Neither campaign required attackers to compromise Anthropic’s infrastructure or register a convincing imitation domain.[1] That distinction matters when assessing a page that appears on a company’s genuine domain: the domain alone did not establish that Anthropic created or endorsed the content.[1] For comparison, the Claude desktop app uses a regular installer from claude.com, not a Terminal command.[3] Teams can use that distinction as a practical prompt to verify installation instructions through the software provider’s official source.