Someone Built a Fake Claude Website Just to Drop Malware, and It's Smarter Than You'd Expect

Let's start with the obvious: if you're downloading Claude from anywhere other than anthropic.com, you're having a bad day. But the people behind the fake Claude-Pro website that Sophos and Malwarebytes just documented weren't counting on you being gullible. They were counting on you being busy.

The site, parked at claude-pro[.]com, pitched itself as a "high-performance relay service designed specifically for Claude-Code" developers. The colors and fonts were close enough. The download button was large and eager. The 505MB ZIP file — "Claude-Pro-windows-x64.zip" — looked like exactly the kind of thing a developer who just finished a long debugging session might grab without thinking twice.

Inside that ZIP was a trojanized MSI installer. The application worked — it was a real copy of Claude, functioning as expected. But in the background, it was deploying a chain that ended with something Sophos is calling Beagle, a previously undocumented Windows backdoor.

The technique is what makes this interesting technically. The installer drops three files into the Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and avk.dll. NOVupdate.exe is a legitimate, digitally signed updater for G Data security software. The attackers use it to sideload the malicious avk.dll, which then decrypts and executes the payload inside the .dat file — an open-source in-memory injector called DonutLoader.

This DLL sideloading trick via signed G Data binaries? Sophos says they've seen it before, linked to PlugX campaigns. These attackers aren't reinventing the wheel; they're reusing proven infrastructure with a fresh coat of AI-brand paint.

The Beagle backdoor itself is relatively simple — it can execute commands, upload and download files, create directories, and remove them. That's a small command set, but for an attacker who just wants a foothold on a developer's machine, it's plenty. (And before anyone asks: no, this Beagle has nothing to do with the 2004 Bagle worm. Different thing entirely.)

The broader point here isn't that malware exists, or even that malware authors are opportunistic. It's that AI branding has crossed a threshold. When a developer searches for "Claude Code relay" or "Claude Pro download," they're now in the blast radius of a campaign that was specifically designed to exploit the gap between trust in a brand and the instinct to just get back to work.

This isn't a story about a sophisticated zero-day. It's a story about how fast the threat landscape adapts to whatever we're all collectively excited about. Three years ago it was crypto wallet scams. Two years ago it was NFT phishing. Now it's fake AI tooling sites, and the attackers have graduated from credential harvesters to full remote-access backdoors.

The lesson isn't "be more careful" — that's useless advice. The lesson is that if a tool becomes essential enough to your workflow, someone will build infrastructure to exploit your relationship with it. Claude, ChatGPT, Copilot — they're all in that category now. Which means the fake download sites are only going to get better.