decrypted · 24 july 2026 · ransomware and cybercrime · uk policy and law · ai and llm security

The fake Claude app that lived on claude.ai, and the 29 firms it caught out

A Bing search for "Claude desktop app" this week could land you on a download page hosted on Anthropic's own domain, claude.ai, built from a legitimate product feature, and stuffed with an information-stealing trojan. Researchers at Huntress found that between 21 and 22 July at least 29 organisations installed what they believed was Anthropic's Claude Desktop client and got SectopRAT instead: a remote access trojan that harvests browser passwords, cookies, autofill data and card details. The page had been viewed over 7,100 times before it came down. Nobody's domain was spoofed. That is exactly the point.

A trusted address, an untrusted page

The mechanism is simple once you see it. Claude Artifacts is a real Anthropic feature: anyone can publish an interactive page at a claude.ai/public/artifacts/ address and share the link, useful for demos, prototypes, small tools. Attackers used it to publish a page that looked like the official Claude Desktop download, bought a sponsored slot on Bing above the genuine search results, and let the browser's address bar do their social engineering for them. The installer itself was a legitimate, signed JetBrains component repurposed to sideload a malicious DLL, with VMProtect packing and GPU-based checks to dodge sandboxes. Every link in that chain was trustworthy alone. Chained together, none of it was.

The Secure by Design lesson

The failure sits with a design choice made long before this campaign: allowing user-published content to live on the same origin as the official product. Anyone judging safety by the domain name, including plenty who know better, has no way to tell a shared prototype from an official release when both sit under claude.ai. The established fix, used by platforms that learned this lesson the hard way, is origin separation: serve user content from a distinct domain that cannot borrow the parent brand's reputation, the way Google keeps user uploads off google.com or GitHub Pages sits on github.io rather than github.com. Anthropic pulled the page once Huntress reported it, but the design gap that let it exist is still there.

For UK organisations the lesson travels well beyond one AI vendor. Any product that lets customers or the public post content under your primary domain, a support portal, a page builder, a chatbot's shared-link feature, inherits the same exposure. Worth an afternoon this week: ask which of your own domains carry content you don't fully control, and whether procurement checklists for AI tools ask vendors how they isolate user-generated pages from official downloads. And for staff, the practical habit still holds: fetch software from an internal catalogue or the vendor's documented URL, never from a paid search result, however correct the domain looks.

Also this week

A ransomware backdoor that hides inside your browser. Cisco Talos this week detailed msaRAT, a Rust implant used by the Chaos ransomware crew that never opens its own connection to attacker infrastructure. Instead it drives a headless Chrome or Edge session over the Chrome DevTools Protocol and tunnels its command traffic out through a WebRTC channel relayed by Cloudflare and Twilio, so what a defender sees on the wire is a browser talking to two entirely legitimate services. Talos's advice is to hunt for browsers launched with headless flags, particularly when spawned by an installer rather than a user. Network-layer blocklists alone will not catch this; it is a reminder that endpoint visibility still earns its keep.

The Cyber Security and Resilience Bill gets its first serious pushback. Peers gave the Bill, which extends the NIS regime to managed service providers, data centres and designated critical suppliers, an unopposed second reading on 14 July, but not an easy ride. Lord Clement-Jones used the debate to call it not nearly ambitious enough, pointing out that it says nothing about AI-enabled attack tooling, that central government and local authorities are largely exempt despite holding the data of every citizen they serve, and that enforcement is split across twelve sectoral regulators rather than one. Committee stage begins on 1 September. UK organisations preparing for the new 24-hour incident reporting duty should note that, for now, their own public sector customers and suppliers may not be under the same obligation.

A compromised developer account turned GitHub Actions into scanning infrastructure. Socket researchers found that ten Packagist packages from a single compromised maintainer account were used, between 12 and 13 July, to push over 580 malicious GitHub Actions workflow files that ran on GitHub's own runners to scan for and exploit cPanel and WHM servers via CVE-2026-41940, a cPanel authentication bypass, then harvest whatever credentials they found. None of it touched the PHP code that developers actually installed. Any UK agency or host running cPanel or WHM should patch now; anyone maintaining GitHub Actions workflows should treat them as executable code needing review, not background plumbing.

Sources

If you're weighing how AI tooling is reshaping your organisation's attack surface, get in touch.

More like this

Get the next post by email: subscribe to Decrypted. Double opt-in, unsubscribe any time, or take the RSS feed.