# How attackers hosted a fake Claude download page on the claude.ai domain

_Thursday, July 23, 2026 at 8:00 AM EDT · Security · Latest · Tier 2 — Notable_

![How attackers hosted a fake Claude download page on the claude.ai domain — Primary](https://img.helpnetsecurity.com/wp-content/uploads/2026/05/27125835/claude-vortex.webp)

Attackers hosted a fake Claude download page on the claude.ai domain by abusing Anthropic's Claude Artifacts feature to funnel users toward malware, Huntress researchers have disclosed.

Employees at at least 29 organizations were compromised over two days in July after searching for the Claude desktop app and clicking a sponsored Bing ad that pointed to the genuine claude.ai domain but landed on an attacker-published public artifact. The artifact rendered a fully functional page that looked like a legitimate Claude download page, and the fact that it was hosted on the Claude.ai domain completed the illusion.

Huntress reported the artifact to Anthropic and it was taken down before the company published its findings on July 22. By then, the page had been viewed 7,100 times.

## Sources

- [helpnetsecurity.com](https://www.helpnetsecurity.com/2026/07/23/anthropic-claude-artifacts-download-malware/)

---
Canonical: https://techandbusiness.org/newswire/LWjgjxb6lEUQVKTUaZuR7y
Retrieved: 2026-07-24T03:52:38.680Z
Publisher: Tech & Business (techandbusiness.org)