Fake Claude Campaign Uses PlugX-Style DLL Sideloading Chain

Researchers observed a malvertising-driven campaign using a fake Claude AI site (claude-pro.com) to distribute a trojanized installer that places NOVupdate.exe, NOVupdate.exe.dat, and a malicious avk.dll in Startup. The signed G DATA updater is sideloaded to load an encrypted payload which DonutLoader executes in memory, delivering a new backdoor dubbed Beagle that supports file operations, command execution, and C2 communications to license.claude-pro.com (8.217.190.58) over TCP 443 and UDP 8080; the report includes IOCs, encryption keys, and recommended mitigations.