Fake Claude Campaign Uses PlugX-Style DLL Sideloading Chain

Hackers are abusing a fake Claude AI download site to deliver a PlugX‑style DLL sideloading chain that ultimately deploys a new Windows backdoor dubbed “Beagle.”

The campaign blends malvertising, a trojanized installer, and signed security software components to achieve stealthy persistence and remote control.

Attackers registered claude-pro[.]com, a site that visually imitates Anthropic’s legitimate Claude interface but offers only a handful of basic links and a prominent download for a fictitious “Claude‑Pro Relay” tool.

Victims are funneled to the site through malicious ads and search‑engine poisoning, a technique widely used in recent AI‑themed malware campaigns.

Sophos X-Ops has been investigating reports of a fake Claude AI website distributing malware.

When executed, the installer drops three files into the user’s Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and avk.dll. This ensures the chain will automatically run whenever the user logs in.

NOVupdate.exe is a legitimate, signed updater component from G DATA antivirus products that normally loads avk.dll from its own directory.

The attackers take advantage of this behavior by placing a malicious avk.dll alongside it, a classic DLL sideloading technique associated with PlugX and other advanced malware families.

When NOVupdate.exe runs, it loads the attacker‑supplied avk.dll, which in turn reads the encrypted NOVupdate.exe.dat file, reverses its contents, and XOR‑decrypts it using a hardcoded key derived from the string “Qby2RSGkGIHumNrDlbt1OEHV3y2dVh5b.”

The resulting shellcode is executed in memory via EtwpCreateEtwThread, mirroring chains previously seen in PlugX campaigns that use a triad of signed EXE, malicious DLL, and encrypted payload.

PlugX-Style DLL Sideloading Chain

The decrypted shellcode is DonutLoader (aka Donut or donut_injector), an open‑source in‑memory loader that injects .NET and PE payloads directly into memory to avoid writing additional executables to disk.

The download is a large Windows archive, Claude-Pro-windows-x64.zip (around 505 MB), which contains an MSI installer named Claude.msi.

In this campaign, Donut loads a previously undocumented backdoor that Sophos has named “Beagle.”

Beagle provides a compact but capable command set, including uninstalling itself, executing arbitrary commands, uploading and downloading files, listing and removing directories, and renaming files.

It communicates with a command‑and‑control server at license[.]claude-pro[.]com over TCP port 443 and UDP port 8080, using AES encryption with a hardcoded key “beagle_default_secret_key_12345!” and a fresh 16‑byte IV for each packet.

JSON‑encoded messages distinguish victim heartbeats (“type”:10) from incoming tasking (“type”:11), enabling operators to queue and deliver instructions to compromised systems.

The malicious Claude site is fronted by Cloudflare, and researchers identified a Cloudflare origin certificate that points to an origin server at 209[.]189[.]190[.]206, suggesting operational missteps by the threat actor.

Additional infrastructure includes 178[.]128[.]108[.]89 hosting vertextrust-advisors[.]com, a bizarre “compliance and legal advisory” site with no clear legitimate footprint, likely tied to the same operators.

The backdoor communicates with the command-and-control (C2) server (license[.]claude-pro[.]com) over TCP (443) and/or UDP (8080). The IP address associated with this domain is 8[.]217[.]190[.]58.

Sophos also found several related samples on VirusTotal that reuse the same XOR key and DLL sideloading pattern, including earlier chains that deliver DonutLoader plus different payloads such as an AdaptixC2 implant and shells reaching out to domains themed around security vendors like Trellix, CrowdStrike, and SentinelOne.

This reuse of code and infrastructure suggests an evolving toolkit where attackers retain a PlugX‑style loader chain while swapping final payloads and brands to fit different lures.

Organizations should treat third‑party download sites for AI tools as high‑risk and enforce policies requiring software to be obtained only from official vendor domains.

Security teams should watch for signed G DATA executables loading non‑standard avk.dll files from user‑writable paths, encrypted outbound traffic to license[.]claude-pro[.]com, and in‑memory DonutLoader activity as indicators of compromise.

Given the active malvertising component, filtering sponsored results, tightening ad‑based browsing policies, and adding targeted detections for PlugX‑like sideloading chains can significantly reduce exposure.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.