Home / Technology / Fake Claude App Delivers Malware
Fake Claude App Delivers Malware
8 May
Summary
- Spoofed website mimics official Claude Pro for malware distribution.
- Infected Claude installers deploy DonutLoader and Beagle backdoor.
- Researchers warn users to verify links due to malicious ads and SEO poisoning.
Security researchers have identified a deceptive campaign targeting users interested in the Claude AI client. Attackers have established a fake website, claude-pro[.]com, designed to mimic the official Claude Pro interface. This fraudulent site delivers poisoned installers to unsuspecting users.
Upon installation, these compromised clients deploy DonutLoader, a malware loader that subsequently installs the Beagle backdoor. The Beagle backdoor is a versatile tool capable of executing commands and managing files on infected systems.
While the specific threat actor remains unidentified, researchers suggest a likely connection to PlugX operators, known for using DLL sideloading techniques. PlugX is a notorious remote access trojan frequently employed by state-linked groups for espionage and data theft.
The perpetrators are suspected of utilizing malicious advertisements and SEO poisoning tactics to guide potential victims to their fake website. This highlights the critical need for users to meticulously verify all online links before proceeding with any software downloads.
