Beagle the hidden backdoor behind a malicious installer that imitated Claude AI

A fake site that mimics Claude AI's website has been used to distribute a malicious installer that apparently offers a "Claude-Pro Relay" but actually installs a Windows backdoor that researchers have baptized as Beagle. The trap combines basic social engineering - a page with colors and typographs similar to the original - with a large download containing a trashed MSI installer to make the application look legitimate while running malicious code in the background.

What is remarkable from the technical point of view is the infection chain: the installer acts as a decoy while dropping a number of components that include a signed executable and a DLL loaded by sideloading, using DonutLoader as in-memory injector and finally the deployment of the backdoor in memory. This combination pursues two objectives: that the user perceives that the application works and at the same time complicate traditional detection based on disk and signatures.

In addition to the mechanics of the attack, there are clear signs of re-use of historical tactics and an operation with a certain degree of sophistication: the use of a signed executable of a security product to load a malicious DLL is a known technique that has been linked in the past to families like PlugX, and communication with the command center is done by means of encrypted channels to a subdomain that emulates the brand of the false service. Public analyses also indicate an IP associated with cloud services as a possible command and control infrastructure.

This case is not isolated: the operators behind these campaigns test different vectors, from decoy PDFs and binary of legitimate supplanted solutions to false update pages of security providers. The pattern reveals that the attack surface is not only the direct download of software, but also the results sponsored by search engines, suspicious mirrors and impostor updates of known software.

For users and administrators the lesson is double. On the one hand, always verify the origin of an installer and download it only from the official supplier's portal (e.g. Anthropic for Claude) or from confirmed repositories drastically reduces the risk. On the other hand, there are technical indicators that should activate alarms: the presence of called files NOVupdate.exe and your partner (.dat / .dll) in start folders, processes that inject code into memory and outgoing communications to unrecognized domains or PIs are signs to investigate.

At the operational level it is appropriate to complement digital hygiene with technical controls: to apply allow-listing of applications, to keep EDR and signatures up to date, to monitor DNS traffic and out of date by unusual connections, and to block IP domains or addresses associated with the campaign where possible. For response equipment, capture the memory of the suspicious process and review in-memory injection techniques will facilitate the detection of loads such as Donut and the extraction of indicators.

Users should also be disconfident of sponsored results and avoid running unverified source installers, and organizations should integrate specific detections into their rules: scanning for name boot such as NOVupdate.exe, audit MSI facilities outside controlled channels and review implementations of signed updates that may be being abused for sideloading.

For those who want to deepen technical findings and campaign monitoring, public detection reports offer context and samples analyzed by independent researchers: see the initial analysis published by Malharebytes documenting the campaign of subplanting and remote access, as well as the work of Sophos that disaggregate the Donut → Beagle chain and the sideloading mechanisms used by the attackers. See analysis in Malharebytes and on Sophos's blog about related tactics and tools in this report.

The conclusion is that the popularity of IA tools has become an attractive hook for social engineering and supply-chain light attacks; protection requires both user common sense and coordinated technical controls on the network and endpoints to prevent a false service from becoming a back door in their systems.