Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Windows and macOS Malware Spreads via Fake “Claude Code” Google Ads
Malware Families
Excerpt
Windows and macOS Malware Spreads via Fake “Claude Code” Google Ads Company Blog For Home For Business For Partners Consumer Insights Labs Business Insights Anti-Malware Research 5 min read Windows and macOS Malware Spreads via Fake “Claude Code” Google Ads Ionut Alexandru BALTARIU Silviu STAHIE March 11, 2026 Bitdefender’s security researchers have discovered a malicious Google Ads campaign that targets anyone looking for downloads related to Claude, the large language model…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | eb4d9a0e4c483dc29ae8c4d31fafcd583c457923d3344745b5c7ab13abed4dc5 | Medium | Score 53/100 | First seen |
| SHA256 | a78e487995ab452c5990b4baff6a4fa485ae2798c2ddd13718c17eb641f11646 | Medium | Score 53/100 | First seen |
| SHA256 | 762fb099115d1917b6f673cc5c74a4b61962a64d640673aaf02566ca6a3dbfa4 | Medium | Score 53/100 | First seen |
| SHA256 | 79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19 | Medium | Score 53/100 | First seen |
| SHA256 | 3b4d3a59024f14cf1f07395afd6957be05d125e00ae8fdcea3a5dee1d8ab9dd3 | Medium | Score 53/100 | First seen |
| SHA256 | 505b32ac2b6fffb5fac81d5bdc2e1e8581fc4196dfb01aee852216a3ad6ff47e | Medium | Score 53/100 | First seen |
| URL | https://download.active-version.com/claude | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…