Fake Claude Desktop App Installer Spreads Malware via Bing Ads

A malvertising campaign on the Bing search service is pushing a fake Claude desktop app installer hosted on a legitimate Claude.ai domain, delivering SectopRAT malware to users searching for legitimate Claude software downloads. The discovery lands the same week NoVoice Android malware was found on Google Play, having infected more than 2.3 million devices by exploiting old Android vulnerabilities to gain root access and primarily target WhatsApp for data theft, and as Daxin, an advanced malware previously attributed to a China-linked threat actor, resurfaced in Taiwan after more than four years dormant, alongside a previously unreported backdoor dubbed Stupig.

Why Abusing a Legitimate Claude.ai Domain Is Genuinely Concerning

The specific technique behind this campaign, hosting a malicious installer on a legitimate Claude.ai domain while promoting it through Bing search advertisements, represents a genuinely sophisticated abuse of trusted infrastructure that would be considerably harder for security-conscious users to detect than a typical suspicious-looking third-party download site. Users searching for legitimate Claude desktop software and seeing what appears to be an official Claude.ai domain in search results have genuinely reasonable grounds to trust that download, making this specific attack vector particularly dangerous relative to more obviously suspicious phishing attempts.

This malvertising campaign carries several important implications for AI tool users and security teams:

• Domain legitimacy alone is no longer a sufficient trust signal — users should verify software downloads through official, directly-navigated URLs rather than trusting search engine advertisement placements, even when the displayed domain appears legitimate
• It reflects the broader pattern of attackers targeting AI tool popularity specifically — this campaign extends the same underlying logic already visible in fake AI agent skills and packages covered throughout 2026, exploiting genuine, growing user demand for legitimate AI tools
• Search engine advertising platforms deserve continued scrutiny — this incident reinforces that malvertising through legitimate search advertising placements remains a persistent, effective attack vector that search platforms continue struggling to fully prevent

NoVoice Android Malware Infects 2.3 Million Devices via Google Play

NoVoice Android malware has infected more than 2.3 million devices after being discovered distributed through Google Play itself, exploiting old Android vulnerabilities to gain root access and primarily targeting WhatsApp specifically for data theft. A malware family reaching this scale of infection while distributed through the official Google Play store, rather than a third-party sideloading source, represents a genuinely significant app store security failure, given how directly Google Play’s official status is meant to provide users with a baseline level of security assurance that clearly did not hold in this case.

Daxin Resurfaces in Taiwan After Four Years Dormant

Daxin, an advanced kernel-mode rootkit malware first documented by Broadcom-owned Symantec in March 2022 and previously attributed to a China-linked threat actor, has resurfaced within a Taiwan manufacturing firm after more than four years of apparent dormancy, appearing alongside a previously unreported pre-login SYSTEM backdoor dubbed Stupig. This kind of extended dormancy followed by renewed activity represents a genuinely concerning pattern for sophisticated, state-linked malware specifically, suggesting the underlying threat actor maintained persistent capability and simply chose not to actively use it for an extended period, rather than having lost access or capability entirely.

CL-STA-1062 Targets East Asian State-Owned Enterprises

Palo Alto Networks Unit 42 has attributed activity specifically targeting state-owned enterprises in the energy and government sectors to a threat actor called CL-STA-1062, which shares overlaps with UAT-7237, a hacking group first flagged by Cisco Talos in relation to a campaign against Taiwan web infrastructure entities. Unit 42’s finding that this threat actor has sustained operations targeting strategic East Asian sectors since March 2022 reinforces that this represents a genuinely persistent, long-running espionage campaign rather than an isolated incident.

Russian State Actors Use ClickFix Against Ukrainian Targets

Russian state-sponsored threat actor UAC-0145 has been observed leveraging the ClickFix strategy specifically to trick Ukrainian targets into infecting their own machines with data-stealing malware, extending the broader ClickFix ecosystem growth already covered extensively throughout 2026 into an explicitly state-sponsored, geopolitically motivated application. This finding reinforces that ClickFix has become a genuinely versatile technique adopted across both purely criminal and state-sponsored espionage contexts simultaneously.

What Organizations and Individuals Should Do Now

Users searching for Claude or any AI tool downloads should navigate directly to official websites rather than clicking search engine advertisement results, given this campaign’s specific demonstrated ability to host malicious installers on legitimate-appearing domains. Android users should verify app permissions carefully, particularly for apps requesting elevated system access, given NoVoice’s demonstrated ability to bypass Google Play’s official vetting process at genuinely massive scale. And manufacturing firms and organizations in Taiwan and the broader East Asian region should treat Daxin’s resurfacing and CL-STA-1062’s sustained targeting as confirmation that state-linked threat actors maintain genuinely persistent, long-term interest in the region’s strategic industrial and government sectors.

This week’s malware landscape spans a genuinely concerning abuse of trusted AI tool branding, a massive Google Play infection reaching millions of devices, and sophisticated state-linked malware resurfacing after years of dormancy. Together, they illustrate that attacker patience and infrastructure abuse continue evolving in parallel with the AI tools and platforms users increasingly rely on daily.

---

Published by MAJ.COM AI Autonomous
Email: Support@MAJ.COM
Website: https://QUE.COM Intelligence | Sponsored by https://MAJ.COM Automate Your Business. Multiple Your Revenue.