Cybercriminals have found a new way to abuse official features of Claude, the AI assistant platform, by hosting fake download pages directly on Claude.ai and using Google Ads promotions to mislead users into installing malware. The trick exploits Claude’s user-generated content tools—Shared Chat and public Artifacts—so phishing pages look legitimate, with the right domain, logo, and padlock icon, even though they’re malicious. The landing page urges users to run Terminal commands on macOS, or PowerShell on Windows, but those commands download “Atomic macOS Stealer” (AMOS) or other payloads designed to harvest passwords, crypto-wallets, browser sessions, and system access. – Gen Digital research, Oct 2026.
The Attack Vector
Rather than registering look-alike domains, attackers simply post fake “Download Claude” or “Install Claude on Windows” pages by abusing Claude.ai’s Artifact and Shared Chat features—legal parts of the Claude experience meant for safe content sharing. They also paid for Google Ads with tracking parameters (like gclid and gad_campaignid) so these fake pages surfaced high in search results. To the average user, the site looks official and secure. – detected by threat analysts.
On macOS the lure is styled as a set of instructions: open Terminal, click copy, paste gibberish, and hit Enter. That launches AMOS, which steals sensitive data including crypto recovery phrases, and even replaces widely used wallet software (Ledger, Trezor) with modified versions that prompt for recovery phrases. On Windows, victims are told to run a PowerShell command via Win + R, Ctrl + V, Enter. This version reaches out to GitHub pages, pulls an encrypted .NET payload, embeds itself within legitimate processes, evades antivirus, and steals wallet info. – both OS versions analyzed.
How to Stay Safe & Indicators of Compromise
Key steps to avoid falling victim include never pasting in commands you didn’t write yourself, using bookmarks or typing official URLs (Claude’s genuine download page is on claude.com/download), and treating any content labeled “user-generated” as suspicious. Be especially wary of software demanding crypto recovery phrases. – recommended defensive practices.
For those potentially affected already: assume full system compromise. From a clean device, change all major passwords, log out everywhere, enable multi-factor authentication, and move any crypto assets to wallets secured with a new recovery phrase. – remediation advice.
| Indicator Type | Indicator | Description |
|---|---|---|
| Domain abuse | claude.ai share/… or artifact/… | Used to host fake download pages via Shared Chat or Artifact routes. |
| URL parameters | gclid, gad_campaignid | Signs of Google Ads campaign funding these malicious links. |
| Methods | Terminal command (macOS) / Win+R → Ctrl+V → Enter (Windows) | ClickFix technique: executes system commands via clipboard or run dialog. |
| Payloads | AMOS on macOS; .NET backdoor on Windows | Steal data, enable remote control, fake wallet apps. |
Research published October 26, 2026 by security teams showed this is a well-funded, ongoing campaign—not just a one-off. Detection tools flagged several Google Ad-backed campaigns that rotate artifacts and shift content to avoid takedowns quickly. – from recent threat report.
What this means: This attacks combines name recognition abuse (using Claude’s brand and domain), ad funding, user trust metrics, and social engineering. The use of features designed for community sharing as attack vectors marks a shift: even authenticated, official domains can’t be fully trusted when users upload content. It underscores the importance of reinforcing guardrails in UGC (user-generated content) systems and improving ad network oversight. Users, meanwhile, must assume risk even when things appear above board—especially with crypto in the mix. Watch how platforms respond: better labeling, more aggressive moderation, and faster ad takedowns will be key to stemming threats like AMOS.
