How Criminals Abuse Claude’s Own Website to Spread Malware

Summary

Threat actors are abusing Claude.ai content-sharing features, including Artifacts and Shared Chats, to host malicious instructions. Using malvertising through Google Ads, attackers lure users into executing ClickFix-style commands in Terminal or PowerShell that install information-stealing malware. The campaigns target both macOS and Windows users, with the goal of stealing credentials, sensitive data, and cryptocurrency.

Investigation

The investigation uncovered two separate campaigns using legitimate claude.ai URLs to host fake “Download Claude” pages. Analysts identified obfuscated one-line commands for macOS that delivered Atomic macOS Stealer (AMOS), while Windows victims received PowerShell commands deploying a .NET-based remote access tool. The campaigns also leveraged Google Ads parameters to redirect users toward these unverified user-generated pages.

Mitigation

Users should never paste commands into Terminal or PowerShell unless they fully understand and trust the source. Organizations should train employees to recognize “unverified content” warnings on AI platforms and avoid sponsored search results when downloading software. Applications should always be obtained directly from the official vendor website.

Response

When compromise is suspected, users should immediately change critical passwords, including banking, email, and cryptocurrency credentials, from a clean device. Enable multi-factor authentication on all supported accounts and terminate active sessions. For cryptocurrency exposure, move funds to a newly created wallet secured with a completely new recovery phrase.

Simulation Execution

• Attack Narrative & Commands: The adversary has crafted a malicious payload (e.g., a fake software update or a credential harvester) and hosted it via a Claude.ai “Artifact.” To avoid detection by reputation-based filters, the attacker sends a link to the victim. The simulation will mimic a user clicking this link, causing the web proxy/server to log a GET request to https://claude.ai/artifact/malicious-payload-id. This action generates the telemetry required by the url|contains logic in the detection rule.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to generate telemetry for Claude.ai content sharing detection.
  
  echo "[+] Starting Simulation: Malicious Content Sharing via Claude.ai"
  
  # Simulate a GET request to a Claude Artifact (Triggers detection)
  echo "[+] Triggering detection via /artifact/ path..."
  curl -s -o /dev/null "https://claude.ai/artifact/malicious-payload-9921"
  
  # Simulate a GET request to a Claude Shared Page (Triggers detection)
  echo "[+] Triggering detection via /share/ path..."
  curl -s -o /dev/null "https://claude.ai/share/attacker-controlled-content"
  
  echo "[+] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # No persistent changes are made to the system during this simulation.
  # Simply clear the shell history to ensure no traces of the test commands remain.
  history -c