Fake Claude AI Site Drops Beagle Backdoor on Windows Users

A fraudulent imitation of Anthropic's Claude website was used in a malvertising campaign to distribute a previously undocumented backdoor named Beagle. The delivered MSI drops a signed G DATA updater (NOVupdate.exe), an encrypted data blob and a malicious avk.dll which is sideloaded; the DLL decrypts the blob, runs shellcode that loads DonutLoader, and deploys the Beagle backdoor communicating with license.claude-pro.com. Researchers found related samples on VirusTotal, reused XOR keys, and hosting split across Cloudflare and Alibaba Cloud, indicating an active, persistent campaign.