# Bing Is Selling You Malware: The Fake Claude App That Drops SectopRAT
The users clicking this ad were not careless. They were developers, analysts, maybe IT staff — exactly the people who should spot a scam. They searched Bing for Claude, Anthropic's AI assistant, because they wanted to install the desktop app and get to work. What they got instead was SectopRAT, a remote access trojan that has been quietly pillaging credentials, browser sessions, and cryptocurrency wallets since 2019.
That's the real story here. This isn't phishing bait thrown at someone's grandmother. This campaign targeted technically literate people with enough professional need for an AI productivity tool that they went looking for it. And Bing served them poison with a paid ad.
## How the Lure Was Built
Malvertising works by buying ad inventory, then weaponizing the trust users extend to search results. Users see a top-of-page result, assume Bing vetted it, and click. What makes this campaign particularly sharp is the domain choice: attackers reportedly hosted the fake installer on a URL constructed to look like a legitimate Claude.ai address — close enough to pass the half-second glance most users give a URL before clicking download.
This isn't novel technique. The playbook has been used against Bitwarden, KeePass, AnyDesk, and nearly every category of software that security-conscious users prefer to download fresh rather than pull from a package manager. "Legitimate-looking domain" is the operative phrase. Typosquats, subdomain spoofing, and abuse of redirect chains all produce URLs that survive casual inspection.
The installer, once executed, drops SectopRAT. The malware is not new — it surfaced publicly around 2019 under the alias ArechClient2 — but it has been actively maintained, which explains why it still circulates in campaigns like this. It's a full-featured infostealer and RAT hybrid: it harvests browser credentials, cookies, and saved passwords across Chromium and Firefox profiles, grabs cryptocurrency wallet data, and can exfiltrate files. Its most distinctive behavior is spawning a hidden secondary desktop environment on Windows, allowing operators to poke around the victim's machine in parallel with normal user activity, mostly invisible.
The combination of trusted brand, paid search placement, and a mature RAT payload makes this a higher-quality operation than the average download-hijack campaign.
## AI Tools Are Now Prime Malvertising Real Estate
The timing is not accidental. AI desktop applications — Claude, ChatGPT, Gemini, Copilot — are in high demand right now, and a meaningful percentage of that demand comes from enterprise users searching from managed corporate machines. Those machines often sit behind endpoint protection that blocks known malware domains but not a fresh typosquat served over HTTPS.
Researchers have been tracking this pattern for about 18 months. Fake ChatGPT installers proliferated through Bing and Google ads starting in mid-2023, primarily dropping Redline Stealer and Vidar. Fake Midjourney ads pushed Aurora Stealer. The threat actors have simply tracked user demand — wherever people are actively searching for software to download, the ads business creates an insertion point, and someone fills it.
What's changed recently is the maturity of the follow-on payloads. Earlier AI-lure campaigns leaned on commodity infostealers. SectopRAT, with its remote access capability, represents a step up. An infostealer grabs what's there and exits. A RAT gives operators a persistent foothold. In a corporate context, that's the difference between a credential theft incident and a sustained network intrusion.
## Bing's Verification Problem
This keeps happening on Bing specifically, and it's worth naming. Google has battled malvertising aggressively — imperfectly, but aggressively — through advertiser identity verification, malware scanning, and ad suspension systems. The consensus among security researchers who track malvertising campaigns is that Bing's ad ecosystem is easier to abuse. Looser advertiser vetting, slower response to abuse reports, and a smaller trust and safety team relative to the platform's reach all contribute.
Microsoft has the resources to fix this. They have not. Every month there's another campaign, another brand hijacked, another pile of credentials harvested from users who had every reason to trust what the search engine showed them.
## What Defenders Should Actually Do
For individuals: browser extensions like uBlock Origin with the right filter lists block most malvertising before the page loads. If you're installing desktop software, the download should come from the developer's official site navigated to directly — never from a search ad. Anthropic's Claude desktop app is available at anthropic.com. That's the only legitimate source.
For security teams: the threat model here is initial access through endpoints that aren't managed to block ad network traffic. If your organization's endpoint protection relies primarily on domain reputation, a fresh lookalike domain hosting a signed installer may bypass it. Behavioral detection — watching for new processes spawning hidden desktops, making unusual outbound connections, or touching credential storage paths — is the layer that catches SectopRAT after execution.
Organizations running fleet deployments should also consider blocking Bing Ads CDN endpoints at the perimeter, or deploying DNS policies that route software-download patterns through proxies that can inspect installer signatures.
## HackWire Analysis
What's underreported in most coverage of this campaign is the target profile implication. AI tool searches skew toward technically sophisticated users — developers, data people, security analysts, IT staff. These are also the users with the most access. A developer's machine often has credentials to cloud infrastructure, source repositories, CI/CD systems, and production environments. If SectopRAT's operators are collecting and reselling access (the likely business model), what they're selling is a category of initial access that's worth significantly more per credential than a consumer's saved passwords.
This campaign also exposes a strategic problem with how enterprises handle software procurement. When organizations push AI tools through informal channels — "just install it yourself, here's the link" — they push employees onto search engines to find installers. That's precisely where these campaigns hunt. Formal software distribution through managed endpoints or an approved internal registry eliminates this vector entirely. It's not glamorous advice, but the malvertising problem is largely a procurement discipline problem wearing a threat intelligence mask.
The SectopRAT payload choice is also worth watching. The pivot from pure infostealers to RAT-capable malware in these campaigns suggests threat actors are moving from smash-and-grab credential theft toward durable access. If that trend holds, the downstream incident response picture gets considerably worse — not a credential reset and cleanup, but a full network compromise investigation.
The Bing ads problem has a simple fix and a political will problem. Microsoft knows. They haven't prioritized it. Until that changes, assume any software you find through a Bing ad could be weaponized.
— HackWire Editorial
---
## Related Coverage