Gen Digital researchers disclosed on October 26 a malvertising campaign that abuses Claude.ai Artifacts to deliver credential-stealing malware without hosting any malicious infrastructure. The campaign works entirely within legitimate claude.ai systems, making it unusually difficult to detect or block at the network layer.
How the campaign works
Attackers purchase Google Ads targeting searches for Claude, AI assistant, and related terms. The ads direct victims to claude.ai URLs that load pre-crafted Artifacts. These Artifacts render as convincing phishing pages, such as fake Anthropic account alerts or Claude Pro upgrade prompts, using the full claude.ai domain and valid TLS certificate. URL parameters including gclid values from Google Ads are passed through and can fingerprint victims for targeted delivery.
Payload by platform
On macOS, the final payload is Atomic macOS Stealer (AMOS). It harvests Keychain passwords, Safari and Chrome cookies, cryptocurrency wallet files, and specifically targets Ledger and Trezor hardware wallet companion apps by replacing their binaries with trojanized versions that exfiltrate seed phrases on next launch.
On Windows, the phishing page triggers a ClickFix-style prompt that instructs the user to paste a PowerShell command. The command downloads a .NET-compiled payload that searches for crypto wallet directories, browser credential stores, and authenticator app databases. The .NET payload is signed with a stolen code-signing certificate to pass initial AV checks.
Why this technique is effective
The campaign exploits the trust gap between the claude.ai domain and the user-generated content rendered within it. Because Artifacts run in an iframe on the claude.ai origin, the browser address bar shows the trusted domain and a valid padlock icon throughout the attack chain. Standard phishing indicators, including domain lookalike checks and certificate warnings, do not apply. Security awareness training that teaches users to check the URL bar provides no protection here.
What to do
Navigate directly to claude.ai by typing the address or using a saved bookmark rather than clicking sponsored search results. Bookmark the official URL and train staff to treat any prompt asking them to paste a command from a claude.ai page with the same suspicion as any other ClickFix prompt. Anthropic has been notified and is investigating abuse reporting mechanisms for Artifacts that function as phishing pages.
Gigia Tsiklauri is the founder of infosec.ge. Get in touch to report a vulnerability, submit a tip, or ask about coverage.