Fake Claude download pages on claude.ai steal passwords and crypto

Researchers at Gen Digital, the company behind Norton and Avast, described two malware campaigns on Monday that host fake installation guides for Claude on claude.ai itself. The attackers use two features that let any user publish content, Artifacts and shared chats. Because the pages are hosted on Anthropic's real domain, there is no misspelled address to give them away. Paid Google ads place them near the top of search results, as tracking parameters in the links show, according to Gen's report on the campaigns.

One pasted command is enough

On a Mac, the page offers a quick install through Terminal. Anyone who copies and runs the command downloads Atomic Stealer, also known as AMOS. The malware first shows a fake password prompt styled like System Settings, then collects browser passwords, session cookies, Keychain data and files such as PDFs and wallet backups. If Ledger Live or Trezor Suite is installed, it replaces the app with a modified copy that later asks for the wallet's recovery phrase.

The Windows page is titled "Install Claude on Windows" and tells visitors to press Win + R, paste with Ctrl + V and hit Enter. That runs a PowerShell command that downloads more code from GitHub. The final payload is a remote access trojan that takes screenshots, searches for crypto wallets and waits for commands from the attackers. Security researchers call this technique ClickFix. Because victims run the command themselves, many built-in protections do not block it.

Not the first campaign of its kind

The trick is not new. In July, a Bing ad led to a similar page on claude.ai, and in early October a fake ChatGPT model on chatgpt.com spread a trojan. A few days later, BleepingComputer reported another Claude campaign that used Google ads. Anthropic does label shared content. On Artifacts, however, the only warning is a thin banner that reads "Content is user-generated and unverified," and Gen notes that "the domain still looks very trustworthy." Gen does not say whether the pages have been removed, and Anthropic has not commented. In August, the company signed out users whose sessions had been hijacked by infostealers, including AMOS on some Macs.

How to download Claude safely

Anthropic offers the desktop app on its official download page at claude.com/download as a regular installer for Mac and Windows. Any guide that asks you to run a Terminal or PowerShell command to install the desktop app is fake. The only exception is Claude Code, which developers do install from the command line, and for that the only guide to follow is Anthropic's own. It is safest to type the address yourself or use a bookmark instead of clicking search ads. Gen advises anyone who has already run such a command to change their most important passwords from a clean device, starting with email and banking, sign out of all sessions and turn on two-factor authentication. Crypto should be moved to a new wallet with a new recovery phrase.