// ClaudeHIGH
Security researchers discovered two coordinated malware campaigns exploiting Claude's content-sharing features (Artifacts and Shared Chats) on claude.ai to distribute malware. Attackers created fake "Download Claude" pages on the real claude.ai domain, promoted them via Google Ads malvertising, and used ClickFix techniques to trick users into running terminal commands that installed Atomic macOS Stealer (AMOS) and Windows malware. The malware harvested passwords, browser credentials, cryptocurrency wallets, and in some cases replaced legitimate wallet apps with trojans to steal recovery phrases.
// Get alerts for Claude