A LinkedIn post about a fake Claude download page sparked a debate: was the attack hosted on the real domain or a fake one? The answer, confirmed by five months of research, is both. And neither version leaves the user with a reliable signal.
On August 28, a security engineer named Mikalai Mikhailau published a LinkedIn post describing something he had found while searching for Claude Code. A sponsored Google Ad appeared at the top of the results. The destination URL showed the real claude.ai domain. The page that loaded was a pixel-perfect replica of the Claude download page. It offered a simple installation: open Terminal, copy a command, paste it, press Enter. The command was not an installer. It was an encoded script that downloaded and ran an infostealer.
The post generated immediate pushback. Another commenter, Tarek Chaalan, argued the post was misleading: the malicious page was not hosted on claude.ai at all, but on an imposter domain that Google Ads mistakenly displayed as the legitimate one. A third commenter, Carolina R., cut through the disagreement with the observation that mattered: “Once the domain and the ad are both legitimate, users lose the main signal we train them to trust.”
What makes this exchange worth examining is not which person was right. It is that five months of documented research shows they both were.
Both versions of this attack are real
In July 2026, Huntress published a detailed investigation of what they called the FakeAgent campaign. Attackers had created a public Claude Artifact, a feature that lets users publish interactive content to a shareable link under the claude.ai domain, and turned it into a fully functional fake download page. Sponsored Bing ads directed users searching for “Claude desktop app” to the artifact. The URL was genuine. The SSL certificate was genuine. The domain reputation was pristine. Twenty-nine organizations were compromised in two days. The artifact accumulated more than 7,100 views before Anthropic removed it.
Separately, Trend Micro tracked a broader campaign they called InstallFix, which used fake Claude installer pages promoted through Google Ads to deliver malware through the same terminal-command technique. BleepingComputer documented a variant using Claude’s shared chat feature rather than artifacts. Trend Micro’s June analysis counted 106 malicious hostnames across six attack waves in seven weeks, with operators continuously rotating infrastructure and testing new AI brand lures.
So the author’s version happened. The commenter’s version also happened. Sometimes the page lives on the real domain through an artifact or shared chat. Sometimes it lives on an imposter domain that the ad platform displays as the real one. The attackers have used both. And that is precisely the problem, because the user training designed to distinguish the two cases relies on a signal that neither case preserves.
What "check the domain" was supposed to solve
For twenty years, security training has taught users a simple verification step: before you enter credentials or download software, look at the URL bar. Is the domain what you expect? Is the certificate valid? If so, you are probably safe. The advice was never perfect, but it was workable when the attack infrastructure lived on domains the attacker controlled. A lookalike domain with a transposed character or an extra word was at least inspectable. A careful user could catch it.
The advice breaks when the domain is real. Claude artifacts live on claude.ai. Google Docs live on docs.google.com. Notion pages live on notion.so. GitHub Pages live on github.io. SharePoint files live on sharepoint.com. Every one of these platforms hosts user-generated content under a domain that every trust model in existence, browser certificates, corporate allow-lists, domain reputation feeds, email security gateways, ad platform verification, greenlights without hesitation.
We have been documenting this pattern across the blog for over a year. The technique has a name in the security research community: Living Off Trusted Sites, or LOTS. Attackers host malicious content on platforms they do not own but whose reputation they inherit. The infrastructure is free, disposable, and carries the trust of the platform rather than the trust of the attacker.
The trajectory was visible before the Claude campaign made it obvious. When we analyzed domains used in active brand impersonation campaigns targeting financial institutions, only 7 percent were registered within 30 days. More than 90 percent were older than 90 days, and 41 percent had been registered for more than five years. Domain age had already stopped working as a trust signal for attacker-controlled infrastructure. The Claude artifact campaign is what comes next: attackers who no longer bother registering domains at all, because they can host on platforms whose domains have been trusted for years.
What the Claude campaign adds to the picture is scale and specificity. This is not a theoretical concern or an edge case. It is 106 hostnames across six waves, 29 organizations in two days, and 7,100 downloads from a single artifact.
The terminal command is the other half
The LinkedIn post highlighted one more dimension that connects this campaign to a technique we covered in detail: the ClickFix pattern.
The fake download page does not serve a file. It displays a command and tells the user to paste it into Terminal. The command is encoded, typically a curl piped through base64 into a shell, which obscures what it actually does. The user executes it voluntarily, which means no browser download warning fires, no endpoint detection trigger trips, and no email gateway has anything to scan. The malware arrives through the user’s own hands.
Chuck Taylor, one of the commenters on the LinkedIn post, named it explicitly: “This is a ClickFix attack, done way better than the ones I’ve seen in captchas.” He is right. The ClickFix technique emerged through fake CAPTCHA pages that instructed users to paste commands to “verify” they were human. What the Claude campaign demonstrates is ClickFix graduating from suspicious CAPTCHA pages to pixel-perfect replicas of legitimate software installation flows, hosted on the real domain of the software being impersonated.
What this means for brand protection
The organizations whose platforms host user-generated content under their own domains face a specific brand exposure. When a fake Claude download page lives on claude.ai, Anthropic’s brand is the trust signal that makes the attack work. When a fake Google login page lives on sites.google.com, Google’s brand is the mechanism. When AI coding platforms become phishing infrastructure, the platform brand absorbs the reputational cost of every compromise that follows.
This is a problem we have seen from the other direction. In a recent operational case study, our team assessed a customer’s own legitimate domain and correctly identified it as not malicious, but the customer’s security team, lacking a domain inventory, overrode the assessment and requested a takedown of their own site. The domain carried every brand marker but no ownership signal. The Claude artifact attack inverts this: the domain is controlled by the legitimate brand, but the content is controlled by an attacker, and the domain’s reputation endorses both equally. Same signal failure, opposite direction, same conclusion: domain-level trust is not content-level trust.
For organizations monitoring their brand exposure, the implication is that domain-based detection alone is insufficient when the impersonation lives on legitimate infrastructure. Detecting abuse of trusted platforms requires monitoring at the content layer, not just the domain layer, and the platforms themselves are beginning to recognize this. Anthropic removed the malicious artifact after it was reported. But 7,100 views happened first.
The Bottom Line
Two security practitioners disagreed on LinkedIn about whether a fake Claude download page was hosted on the real domain or a fake one. Five months of research from Huntress, Trend Micro, BleepingComputer, and Malwarebytes shows both versions are real, both are active, and both break the verification rule users have relied on for two decades. The question is no longer whether “check the domain” is reliable advice. It is what replaces it when the domain is real, the certificate is valid, the ad is legitimate, and the attack is already running.
Key Takeaways
Attackers hosted a fake Claude download page as a public artifact on the legitimate claude.ai domain and promoted it through sponsored Bing and Google ads. The page was a pixel-perfect replica of the real Claude installer that delivered encoded terminal commands installing infostealer malware. Huntress confirmed 29 organizations were compromised in two days in July 2026, with 7,100 downloads before Anthropic removed the artifact. Trend Micro documented 106 malicious hostnames across six attack waves in seven weeks targeting Claude and other AI platforms.
Because major platforms now host user-generated content under their own trusted domains, attackers can publish malicious pages that inherit the platform’s reputation without registering a single domain. Claude artifacts live on claude.ai. Google Docs live on docs.google.com. GitHub Pages live on github.io. The URL is real, the certificate is valid, and the domain is legitimate. Allure Security’s own detection data shows this is the endpoint of a longer trend: in active brand impersonation campaigns, over 90 percent of malicious domains were already old enough to pass age-based trust checks before attackers began abandoning domain registration entirely.
LOTS, or Living Off Trusted Sites, is a phishing technique where attackers host malicious content on legitimate platforms rather than on infrastructure they control. The attacker inherits the platform’s domain reputation, SSL certificate, and corporate allow-list status. The Claude artifact campaign is a LOTS attack. So are phishing pages hosted on GitHub Pages, Google Sites, Notion, and SharePoint. Traditional domain-based detection cannot distinguish the malicious content from the legitimate platform.
ClickFix is a social engineering technique where attackers display encoded terminal commands and instruct users to copy and paste them into their device’s command line. Because the user executes the command voluntarily, no browser download warning, endpoint detection trigger, or email security scan is activated. The Claude campaign used ClickFix to deliver its payload through what appeared to be a standard software installation flow, hosted on the real claude.ai domain.
Domain-based detection alone is insufficient when the impersonation lives on legitimate infrastructure. Detection must operate at the content layer: identifying credential harvesting pages, fake download flows, and social engineering lures based on what they do rather than where they are hosted. Allure Security’s operational experience confirms that domain ownership signals fail in both directions, with legitimate domains mistaken for threats and trusted domains hosting malicious content simultaneously.
