Claude Desktop (claude.exe) fetching resources from malware-flagged domains [BUG]

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Antivirus (Avast) has blocked multiple outbound connections initiated by claude.exe (Claude Desktop app) to domains flagged as malicious. This happened 3 times in one day. I first suspected the "Claude in Chrome" browser extension, but uninstalling it did not stop the blocks — the process is claude.exe itself, confirming this is coming from the desktop app, not the browser extension.

Blocked connections observed:

URL: https://ledgermcp.com/icon-512.png
Avast category: URL:Block [CryptScam] — crypto investment scam site
Process: C:\program files\windowsapps\claude_1.24012.11.0_x64__pzs8sxrjxfjjc\app\claude.exe
Detected at (in-app location): mainMenu.advSecurity.sage.title
URL: https://pablooo.club/favicon/favicon.svg
Avast category: URL:Blacklist — general malware blacklist
Process: same as above
Detected at (in-app location): mainMenu.advSecurity.sage.title
Both detections point to the same internal location string (mainMenu.advSecurity.sage.title), suggesting these are icon/favicon fetches triggered by the same UI feature — possibly a connectors/marketplace/skills listing that pulls data (including icons) from a remote, insufficiently vetted registry. "ledgermcp.com" appears to be impersonating the Ledger crypto wallet brand, a known scam pattern targeting crypto users.

Impact: No malware was executed and no data was exfiltrated — Avast blocked both connections at the network level before completion. However, the app fetching resources from known-malicious domains suggests a malicious/spoofed entry has made it into whatever data source feeds this UI feature — a supply-chain risk for all users of that feature.

Environment:

App version: claude_1.24012.11.0_x64
OS: Windows 11 Home 10.0.26200
Antivirus: Avast (blocked both connections automatically)

What Should Happen?

Clude shouldn't try to open sites like these.

Error Messages/Logs

Steps to Reproduce

Please investigate what feature/menu corresponds to mainMenu.advSecurity.sage.title and audit the data source it pulls connector/icon URLs from for malicious entries.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

claude_1.24012.11.0_x64

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

_No response_