Fake Claude AI Site and the Beagle Backdoor
TL;DR: Sophos X-Ops researchers discovered claude-pro.com, a clone site of Claude AI distributing "Beagle," a never-before-seen Windows backdoor. The site reaches victims through sponsored Google ads placed above the real Claude's organic results. Once installed, Beagle grants full remote control of the machine.
The world's most widely used AI services have become the perfect bait for cybercriminals. The name "Claude" guarantees credibility. Sponsored ads guarantee visibility. The result is a backdoor installed by users convinced they're downloading a legitimate tool.
The Clone Site: claude-pro.com
The malicious site is claude-pro.com — not to be confused with Anthropic's real Claude AI, found at claude.ai.
The clone replicates Claude's interface with precision: similar layout, identical color palette, matching fonts. A user who lands on the site without checking the domain in the address bar is unlikely to notice the difference.
The site promotes a fictitious tool called "Claude-Pro Relay," presented as an enhanced version of the chatbot. To use it, the user has to download a ZIP archive of about 505 MB.
The hosting infrastructure, tracked by Sophos X-Ops, was set up in March 2026.
How the Site Reaches Victims: Malvertising
The distribution channel is malvertising — malicious advertising inserted into Google search results as a sponsored ad.
When a user searched for "Claude AI" or related terms, the fake site appeared at the top of the results, ahead of Anthropic's real Claude. Anyone who clicked the ad without checking the domain landed directly on the clone.
It's a well-established technique, but pairing it with a high-profile AI service like Claude — which has millions of active users — massively amplifies the attack's potential reach.
How the Infection Works
The downloaded ZIP file contains an MSI installer. Once run, it drops three files into the Windows startup folder:
| File | Role |
|---|---|
NOVupdate.exe | Legitimate G DATA antivirus updater, renamed |
| Encrypted data file | Encrypted malicious payload |
avk.dll | Malicious DLL |
When Windows starts up, it automatically runs NOVupdate.exe. The legitimate updater, looking for its own library, instead loads avk.dll — a technique known as DLL sideloading.
The DLL decrypts the data file using a reversed XOR key and injects the resulting code into memory via DonutLoader, an open-source in-memory loader. At this point, Beagle is active — without any explicit malicious file being visible on disk.
The Beagle Backdoor: Capabilities and Communications
Beagle is a Windows backdoor undocumented before this discovery. It supports 8 commands:
- Shell command execution via CMD and PowerShell
- Upload and download of arbitrary files
- Browsing the filesystem (directory listing)
- Creating folders
- Renaming files
- Deleting directories
- Self-removal from the system
It communicates with the command-and-control server at license.claude-pro.com over:
- TCP port 443 (standard HTTPS — hard to block with a firewall)
- UDP port 8080 (alternate channel)
All traffic is encrypted with a hardcoded AES key. Whoever controls the C2 server has full access to the infected machine.
Why AI Has Become the Ideal Vector
The success of this type of attack comes down to three converging factors:
1. Brand trust: ChatGPT, Claude, Gemini are names users associate with advanced, reliable technology. Imitating these brands lowers people's guard.
2. Download expectations: users are used to downloading software. A "desktop client" for an AI service seems plausible — in reality, no legitimate AI service requires installing a 500 MB ZIP file.
3. Malvertising is hard to filter: sponsored Google ads have a history of being abused to distribute malware. Google removes flagged sites, but criminals quickly register new ones.
How to Protect Yourself
- Don't click on sponsored ads for AI services: always type the URL directly into the address bar
- Check the domain before taking any action: claude.ai, not claude-pro.com or variants
- Don't download executables from AI sites: ChatGPT, Claude, Gemini are web services — they don't require installations
- Use an ad blocker: block sponsored ads in search results, eliminating the main malvertising vector
Conclusion
The Beagle backdoor isn't sophisticated in its logic — it's sophisticated in its distribution. It exploits user trust in AI brands, the sponsored ads mechanism, and proven evasion techniques like DLL sideloading. The message for anyone using AI services is simple: the URL in the address bar is the first line of defense.
Sources: Sophos X-Ops · BleepingComputer · Infosecurity Magazine · TechRadar