Fake Claude Campaign Deploys Malware Through DLL Sideloading Chain

Attackers are distributing a trojanized Windows installer from a fake Claude site (claude-pro.com) that contains an MSI which drops NOVupdate.exe (a signed G DATA updater), a malicious avk.dll, and an encrypted payload. The chain abuses DLL sideloading to run shellcode that launches DonutLoader and installs a newly documented backdoor called Beagle; researchers found related samples reusing an XOR key and domains spoofing major security brands, suggesting a multi-lure campaign likely delivered via malvertising or poisoned search results.