Cybersecurity firm Sophos X-Ops recently discovered a phishing website claude-pro[.]com impersonating Anthropic’s Claude AI, which is distributing a previously undocumented remote backdoor called Beagle to Windows users. The site mimics the legitimate Claude interface but is used for malware delivery. Attackers offer a fake tool named “Claude-Pro Relay” on the site; the approximately 505 MB ZIP archive downloaded by users contains hidden malicious payloads.
Sophos’ analysis reveals that Beagle infiltrates systems through a DLL side-loading chain. The attackers abuse a signed G DATA antivirus update binary file, combined with an encrypted data file, to achieve stealthy execution. Researchers initially suspected it was a PlugX variant, as a February report from Lab52 described a similar combination of a signed binary and avk.dll side-loading. However, further investigation confirmed that Beagle is an entirely new backdoor. The malicious domain’s hosting server was set up in March 2026, and the attack remains ongoing as part of an active malvertising campaign.
