cybersecuritynews.com
Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware
Cybercriminals are using a counterfeit Claude desktop application to compromise Windows systems, disable key security checks, and install remote-access malware.
The campaign turns a familiar AI software search into a route for credential theft and long-term access. It also shows how trusted-looking download pages can make a dangerous file appear routine.
For organizations, the campaign creates risk beyond one endpoint because stolen credentials may open the door to email, cloud services, and internal systems.
The attack begins with malicious search advertisements that steer victims toward convincing public artifact pages. After a user downloads and runs the supposed installer, the infection moves quickly through several stages.
The final payload is SectopRAT, a remote-access tool that can steal information and give attackers hidden control of an infected device. Such access can let criminals collect files, watch activity, or return later with further instructions.
CyberProof said in a report shared with Cyber Security News (CSN). Its analysts noted that the activity matches the FakeAgent campaign previously tracked in the wild, where attackers abuse public hosting and spoofed installers to deliver malware.
The incident was identified from an alert involving a scheduled task designed to look like a normal software update. Analysts then correlated evidence across the affected endpoint instead of treating that signal as a standalone event.
The case underlines a wider problem for businesses and home users alike. A familiar name is often enough to lower a victim’s guard, particularly when an advertisement appears above legitimate search results.
Recent reporting on fake Gemini installer attacks shows that criminals are also exploiting other popular AI brands to push credential-stealing malware.
Hackers Use Fake Claude Desktop App
Once the victim launched the counterfeit application, it used PowerShell to add exclusions for folders in the user profile, reducing Microsoft Defender visibility over the area where malicious files were staged.
The initial loader then used DLL sideloading, a method that makes a legitimate program load a harmful supporting file. This allowed the code to run in the context of a signed Java Chromium Embedded Framework helper.
The Initial Alert (Source – CyberProof)
The mismatch between the displayed application name and the program’s internal details was a valuable warning sign.
The malware also created a logon-triggered task with elevated privileges while disguising it as a browser updater. That task called a second loader from a user-writable roaming folder, allowing the infection to return after a reboot.
Abuse of native scheduling features remains a proven way to retain access, as shown in reports on Windows scheduled task abuse .
CyberProof’s investigation found that the operators avoided a conventional command server. Instead, the malware relied on EtherHiding, retrieving encrypted connection details from Ethereum blockchain data.
That approach can make takedowns harder because the attacker can rotate infrastructure without relying on one fixed domain or server.
Containment Needs Full Response
Researchers stressed that removing a visible task or one malicious file is not enough when remote-access malware has executed.
In the observed incident, responders isolated the device, removed unauthorized Defender exclusions, revoked user sessions, reset credentials, and reimaged the endpoint. They also reviewed identity and access activity to check whether stolen credentials had been used elsewhere.
Defenders should investigate newly created high-privilege tasks that launch software from Downloads, AppData, or other user-controlled locations.
The agent’s attack chain reconstruction (Source – CyberProof)
They should also flag new antivirus exclusions made soon after a download and inspect unexpected library loads outside normal program folders. Similar chains that combine spoofed software and library loading have appeared in AsyncRAT fake installer campaigns .
Organizations can reduce exposure by directing staff to approved software channels and restricting local installation rights where practical. Search advertisements for developer and AI tools deserve extra caution, even when the landing page looks legitimate.
Monitoring browser-originated downloads, scheduler changes, security-setting changes, and blockchain RPC traffic together can help teams recognize the full attack rather than treating each alert as an isolated event.
That broader view is important when attackers intentionally spread their activity across several ordinary Windows features.
Indicators of Compromise (IoCs):-
Type Indicator Description File name ClaudeDesktop.exe Initial trojanized loader File metadata JCEF Helper / jcef_helper.exe Internal metadata associated with the fake loader File name DockerDesktop.exe Staged loader used for reboot persistence File name libcef.dll VMProtect-packed DLL used in the sideloading chain File name tempdir.dll DLL name included in the hunting logic for suspicious sideloading activity File name Claude.exe Suspicious installer-related file name included in hunting logic File name ClaudeSetup.exe Suspicious installer-related file name included in hunting logic File name Docker Desktop.exe Suspicious installer-related file name included in hunting logic File path AppData\Roaming\EdgeUpdate-1b4adb1f\ User-writable staging directory Scheduled task MicrosoftEdgeUpdate Disguised logon persistence task configured with elevated privileges Domain downloading-api.it.com Malvertising download infrastructure Domain neeitoerw[.]my Suspicious domain observed in the process lineage IP address 153.75.84.173 Network infrastructure observed in the process lineage URL pattern claude[.]ai/public/artifacts/[id] Masqueraded lure artifact page URL / domain download-app.us Suspicious origin included in hunting logic URL / domain claude-desktop.gitlab.io Suspicious origin included in hunting logic URL / domain claude.ai.download-app.us Suspicious origin included in hunting logic URL path it.com/html/claude/win Suspicious origin included in hunting logic Domain claude-code-cmd.squarespace.com Suspicious origin included in hunting logic URL path code.claude.ai/download Suspicious origin included in hunting logic Domain install-files.com Suspicious origin included in hunting logic Keyword claude-code Suspicious origin keyword included in hunting logic Keyword claude-desktop Suspicious origin keyword included in hunting logic SHA-256 f8acb8f5... Partial hash of the initial payload, as published in the source report
Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM .
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post Hackers Use Fake Claude Desktop App to Disable Defender and Install Remote Access Malware appeared first on Cyber Security News .
