Scammers are spreading fake Claude installers loaded with malware

There is a new trend on the dark side of the internet: scammers are building fake websites for Claude, ChatGPT and other popular AI tools, then distributing malicious "installers" through spam and social media. An inattentive user clicks a link, thinks they are downloading a useful AI assistant, and gets malware instead.

How the attack works

The scheme is simple but effective. Scammers build websites that look almost identical to the original claude.com: the same logos, colors and text. But the domain name differs by one or two letters: claudde.com, claud3.com, or a lookalike that swaps in a Cyrillic letter for a Latin one. Such typos are easy to miss when you are in a hurry.

Links to the fake sites are spread through spam mailings, fake LinkedIn and Telegram accounts, and search results manipulated with SEO. The victim clicks and sees a nicely designed download page with a "Download installer" button. The file downloads, the user runs it, and a trojan is installed instead of Claude.

What is inside a fake installer

The contents depend on the attacker's skill. In simple cases it is an ordinary trojan that steals account credentials and passwords saved in the browser. In more sophisticated cases it is modular malware that can download additional components: spyware, a crypto miner, ransomware.

The danger lies in the disguise. While the malware runs in the background, the user sees a Claude installation window, waits a few minutes, and gets a success message. Everything looks normal. But malicious processes are already running, hidden, in the background.

• A trojan that steals passwords and cookies
• Spyware that logs keystrokes and takes screenshots
• A crypto miner that burns your PC's electricity
• A backdoor giving hackers remote access
• Ransomware that encrypts your files for a ransom

How to avoid getting caught

The main rule: download AI tools ONLY from official sources. For Claude, those are: the claude.ai web app (browser only, nothing to install), the mobile app from the App Store (iOS) or Google Play (Android), and the source code and API at github.com/anthropic-ai (for developers).

The second rule: don't skip checking the link before you click. Hover over the button and look at the bottom-left corner of the browser. What URL does it show? If it is not claude.ai or anthropic.com, don't click.

The third rule: pay attention to small details. Fake sites often give themselves away: typos in the Russian translation, odd design, no HTTPS (there will be no green padlock next to the address in the browser). The official claude.ai always uses a secure connection.

What this means

As AI tools grow more popular, so do attacks on their users. Scammers know people want to try Claude or ChatGPT, and they use that desire as bait to spread malware. So the best defense is attentiveness and a simple rule: links from social media and email are the enemy, the official website is a friend.