Hackers Use PlugX-Like DLL Sideloading Chain in Fake Claude Malware Campaign

Researchers observed a malicious campaign hosted on a fake Claude AI site (claude-pro.com) distributing a ZIP with a signed installer that performs DLL sideloading (replacing avk.dll) to load an XOR-encrypted DonutLoader shellcode and deploy a newly identified Beagle backdoor that communicates with license.claude-pro.com using a hardcoded AES key; the report includes IoCs (domains, IPs, filenames, encryption keys), evidence of multiple related samples across 2026, and mitigation advice such as downloading only from official sources and monitoring startup folders and outbound connections.