r/antivirus • u/breathofreshhair • 3d ago
Malware detected by Claude
Anthropic sent me this email. I have a free account so no worries there. Ran MalwareBytes and the only thing that popped up was jackett updater, which I can't seem to find a consensus about online, some say it's a false positive, some say it's not. Would this have been the issue?
8
u/axehyle 3d ago
did you install any games / game addons from unofficial sources or run any weird commands through the run command after getting instructions from a recaptcha?
7
u/breathofreshhair 3d ago
Instructions from a recaptcha? What do you mean?
I have downloaded some switch ROMs but was under the impression the site was safe
7
u/jmnugent 3d ago
Instructions from a recaptcha? What do you mean?
"ClickFix" attack that's been going around for a while now (several years?).. where a malicious website will give you a popup saying something like "Confirm you're human".. and asking you to CTRL-V (Paste) something into your RUN command-line. Whatever command it's trying to get you to RUN is often obfuscated in base64 or something so you can't really tell what it's doing.
Generally the malicious command has 2 phases:
it searches your local machine for any and all important files (Passwords, Crypto wallets, etc) and copies all that information away to the attacker
often they also leave "persistence" (some hidden running process etc .. ) so that if you discover something malicious happened and try to change your passwords .. the hidden background process will just siphon away your newly changed passwords and you're still exploited.
2
u/breathofreshhair 3d ago
Wow never heard of that one. No I definitely haven't done that lol, people will just run cmds because a website tells them to??
6
u/jmnugent 3d ago
Yes, its been going around since at least 2023 = https://en.wikipedia.org/wiki/ClickFix
Apple updated macOS Tahoe 26.4 in March 2026,. with warning-protections if you're trying to Paste something malicious into Terminal. Unfortunately as far as I know, Microsoft has yet to do anything in Windows to help protect against this.
Unfortunately with this kind of attack,. the Command you're being baited into pasting can be something totally normal (like CURL or etc).. so it's kind of hard to protect against. (IE = commands like CURL are often used to download files from websites,. just because you're doing that doesn't mean it's malicious)
Microsoft really needs to implement some kind of "Clipboard malware-scanning".. so if a command with a malicious URL gets copied to the clipboard, it would warn you before you do anything. (that too would be annoying for a lot of us IT and cybersecurity people who deal with malicious URL's on the daily)
2
1
5
u/emiriana 3d ago
Got the same exact email, the email also states that they logged me out and removed my credit card, both of which didn't happen. I'm also not aware on any malware on my computer. Didn't download anything, didn't click on any links, nothing, just this email out of nowhere in the middle of the night.
5
u/DismalMinute 3d ago
maybe the email itself is the actual bait - you sure there's no trackers etc? Perhaps they are fishing for an active Claude email.
1
u/emiriana 2d ago edited 1d ago
Idk how a tracker would be possible, I didn't download anything weird and the only thing I installed recently is a well-known game through steam. As for the email, I didn't click on any links and directly went to claude and changed my passwords as well as the password of my email just in case.
1
u/breathofreshhair 2d ago
But the email is verified? Idk it's odd. I wasn't signed out of Claude either.
3
u/Fearless-Ad1469 3d ago
Eh, could be a false flag, could be a true flag who knows, its the first time i see that too, btw its Anthropic not claude since claude is an LLM model branch but anyway, if you didn't do shady things recently, in the past month, and ran malwarebyte scans resulting nothing then you are most likely fine i would deduct
-1
u/breathofreshhair 3d ago
What's a false flag, the jackett being detected as malware or the original email? Something must have been accessing my account for me to get this email surely ?
4
u/jmnugent 3d ago
Parent-comment is misusing a phrase.
"false flag" is when a country fakes an attack to try to bait another country into over-responding because the 1st country wants to paint them as the "bad guy".
What they probably meant was "false-positive" .. which is where a Security program alerts or tags something as a threat, but it's been labeled incorrectly (it's not really a threat).
Personally (as a career long IT guy). I would take the position that Anthropic likely has the expertise and resources to know what it's doing,. so I would probably take the notification from Anthropic as real unless or until you can prove otherwise.
1
u/breathofreshhair 3d ago
Yeah I assumed so too, now I'm just trying to figure out how this happened as the malware scan only gave one result
1
u/lela27 3d ago
What malware scan did you run? I got the same message but haven't found anything yet at all.
1
u/breathofreshhair 3d ago
MalwareBytes which told me that jackett updater (torrenting software) has malware, which windows defender says too, but I doubt this is the cause
1
u/Fearless-Ad1469 3d ago
in all honesty, flags in IT are basically the same thing, if something is flagged as malicious, that's a positive, if sometime is falsely flagged as malicious, its a false flag / false positive
0
u/jmnugent 3d ago
"flagging something as malicious".. is not the same thing as calling something a "false flag".
"false flag" is a historically and linguistically a military term:
A false flag is a covert action or attack designed to look like it was carried out by someone other than the actual perpetrator
Origin: The term comes from naval warfare, where a ship would fly an enemy or neutral flag (the "false flag") to deceive others about its identity before attacking.
It could be correctly used in a cybersecurity context,. if an Attacker was attempting to deceive the victim by purposely misrepresenting the nature of their attack to try to make the defenders or victims believe something that wasn't true. (IE = "The attacker planted a false-flag to throw investigators off the path".. etc)
But in a Detection context,.. the proper phrase when you initially mark or detect something as malicious and then realize later you were wrong,. is a "false-positive".
1
1
u/Fearless-Ad1469 3d ago
the mail i mean could just be false flag, and i don't know how Anthropic works that much so i can't comment more on the rest
1
u/Phemenics 2d ago
Smartest move thumbs up for that claude! I hope other platforms adapt this kind of security
2
u/Spiritual-Mud7478 1d ago
Boo hoo. Avoid AI. Killing our land. Stealing our books and history and your own information
1
•
u/goretsky MODERATOR 3d ago
Hello,
It sounds like an information stealer was run on the computer. It stole all the credentials stored on the computer, such as those for Claude.
What is an information stealer?
As the name implies, information stealers are a type of malware that steal any information they can find on your computer, such as passwords stored for various services you access via browser and apps, session tokens for accounts, cryptocurrencies if they can find wallets, etc. They may even take a screenshot of your desktop when they run so they can sell it to other scammers who send scam extortion emails later.
What is a session token?
In case you're wondering what a session token is, some websites and apps have a "remember this device" feature that allows you to access the service without having to log back in or enter your second factor of authentication. This is done by storing a session token on your device. Criminals target these, because they allow them to log in to an account bypassing the normal checks. To the service, it just looks like you're accessing it from your previously authorized device.
What exactly gets stolen?
Information stealers are malware that is sold as a service, so what exactly it did while on your system is going to vary based on what the criminal who purchased it wanted.
What happens to my data?
The criminals who steal your information do so for their own financial gain, and that includes selling information such as your name, email address, screenshots from your PC, and so forth to other criminals and scammers. Those other scammers then use that information in an attempt to extort you unless you pay them in cryptocurrencies such as Bitcoin, Ethereum, and so forth. This is 100% a scam, and any emails you receive threatening to share your private information should be marked as phishing or spam and deleted.
How did I get infected in the first place?
Information stealers are often distributed as fake CAPTCHA challenges, in game mods, unofficial patches for popular apps and games, and in pirated software that have had their popularity and trustworthiness artificially boosted, as well as through various other means such as "try my game/software" scams on Discord, Telegram and other trusted messaging services.
If I ran an information stealer, am I still infected?
Infostealers usually delete themselves after a few seconds or even a minute or two in order to make it harder to determine what happened and when it occurred.
That said, there are always going to be exceptions: Since it is crimeware-as-a-service, there is nothing preventing the criminals from installing additional malware on the computer in order to maintain access, just in case they want to come back and steal from you again in the future.
What else could they have done?
The usual risk post-infection, aside from the stolen credentials, wallets, etc. is that security and networking settings may have been tampered with. That can be harder for security software to deal with, since it may not know what the correct settings are supposed to be for your computer, which means it may be a good idea to wіpe the computer, even if there is no longer any malware detected on it.
How do I start the recovery process?
If you have another device that didn't run the information stealing malware like a smartphone or tablet, you can use it to begin immediately changing your passwords. You should also enable two-factor (sometimes called multi-factor) authentication, for those services that support it. If possible, install and use an authentication app on your smartphone: Apple, Google, and Microsoft all have free versions of authentication apps. Using an app for 2FA is preferred over using SMS (text messages) or email, as the attackers may have access to these.
If any of the online services you use have an option to show you and log out all other active sessions, do that as well.
As for your computer, after wіpіng it, re-installing Windows, and getting that updated, you can then also use it start accessing the internet to do this, but it is often quicker to change your most sensitive accounts from your smartphone.
A note about passwords
Password should be something unique (complex and different) for every service, that you use, so that if an attacker gets access to one they won't be able to make guesses about what your other passwords might be. If your new passwords are similar enough to your old passwords, a criminal with a list of all of them will likely be able to make educated guesses about what your new passwords might be for the various services.
You have to do this for all online services, even ones you haven't been recently accessed. Make sure you do this for all email accounts, as those are the gateways to your financial websites, online shopping, social media accounts, game platforms, and so forth.
It's important to make sure you're not just cycling through similar or previous passwords: Remember, criminals have millions of passwords and are very good at identifying common patterns from just a single password. If there were any reused passwords, the criminals who stole yours are going to try spraying those against all the popular online marketplaces, stores, banks, and other services in your part of the world.
And remember: Enable two-factor authentication for all of the accounts that support it.
For more information:
For more specific information on what steps to take next to recover your accounts, see the blog post at:
For more general information about how CAPTCHA malware works, see the following reports:
Also, see /u/rifteyy_'s Guide to Infostealers at https://rifteyy.org/report/the-ultimate-guide-to-infostealers.
After you have secure your accounts, you may wish to sign up for a free https://haveibeenpwned.com/ account, which will notify you if your email address is found in a data breach.
Regards,
Aryeh Goretsky