Researchers at Gen Digital, the company behind Norton and Avast, described two malware campaigns on Monday that host fake installation guides for Claude on claude.ai itself. The attackers use two features that let any user publish content, Artifacts and shared chats. Because the pages are hosted on Anthropic’s real domain, there is no misspelled address to give them away. Paid Google ads place them near the top of search results, as tracking parameters in the links show, according to Gen’s report on the campaigns.

One pasted command is enough

On a Mac, the page offers a quick install through Terminal. Anyone who copies and runs the command downloads Atomic Stealer, also known as AMOS. The malware first shows a fake password prompt…