Fake Claude AI Download Site Delivers Trojanized Installer Deploying PlugX RAT via G DATA DLL Sideloading
Fake Claude AI Download Site Delivers Trojanized Installer (TL-2026-0349), also tracked as Fake Claude Pro Installer Campaign, is a high-severity malware campaign, first published 2026-04-10. It is attributed to Earth Preta cluster (China) with medium confidence, affects Anthropic Claude Desktop (impersonated), maps to 28 MITRE ATT&CK techniques (T1016, T1036.001, T1036.005), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-0349
- Threat ID
- TL-2026-0349
- Also known as
- Fake Claude Pro Installer Campaign, Cluade Typosquat PlugX Campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-04-10
- Last reviewed
- 2026-04-10
- Attribution
- Earth Preta cluster
- Attribution confidence
- MEDIUM
- Nation-state nexus
- China
- Motivation
- ESPIONAGE
- Target sectors
- technology, software-development, security-research, academia, media, professional-services, ngos, government-policy
- Target regions
- North America, Europe, Asia Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Fake Claude AI Download Site Delivers Trojanized Installer
Malware and tooling: PlugX, G DATA NOVUpdate.exe (abused signed binary)
A fake Anthropic Claude download site distributes a trojanized Windows installer (Claude-Pro-windows-x64.zip) that installs a working copy of Claude while silently deploying a PlugX RAT chain using a legitimate signed G DATA antivirus updater (NOVUpdate.exe) to sideload a malicious avk.dll, decrypting an XOR payload from NOVUpdate.exe.dat and beaconing to Alibaba Cloud C2 8.217.190.58:443 within 22 seconds of execution. The campaign reuses a G DATA DLL sideloading triad technique publicly documented by Lab52 in February 2026 and is historically associated with Chinese state-aligned PlugX operators (Mustang Panda / Earth Preta cluster).
How Fake Claude AI Download Site Delivers Trojanized Installer works
On April 10, 2026, Malwarebytes threat researcher Stefan Dasic disclosed an active malware distribution campaign leveraging a fake Anthropic Claude download website to deliver a trojanized installer that installs a functional copy of Claude while simultaneously deploying a PlugX remote access trojan (RAT) chain on the victim endpoint. The campaign exploits the surging popularity of AI desktop tooling (Claude receives approximately 290 million monthly web visits) as a social engineering lure targeting developers, security researchers, and enterprise knowledge workers.
The fake site presents itself as an official Anthropic download page for a fictional Claude Pro Windows build and serves a ZIP archive named Claude-Pro-windows-x64.zip. Passive DNS telemetry shows the impersonating domain has been equipped with active bulk-email infrastructure, with MX records rotating between two commercial bulk-email providers — Kingmailer (last observed March 28, 2026) and CampaignLark (observed from April 5, 2026) — indicating operator maintenance of a sending capability suitable for phishing distribution in addition to web-based drive-by or search-ad delivery.
The archive contains an MSI installer that deploys files under C:\Program Files (x86)\Anthropic\Claude\Cluade\ — a deliberate typosquat of the legitimate path that mirrors the Squirrel update framework layout used by real Electron-based Anthropic Claude installers. The installer drops a lure LNK (Claude AI.lnk) on the user Desktop pointing at Claude.vbs inside a SquirrelTemp subdirectory. When the victim clicks the Desktop shortcut, the VBScript dropper locates the genuine claude.exe two directory levels above SquirrelTemp and launches it in the foreground, providing the victim with a fully working Claude application.
With the legitimate application running as cover, the VBScript copies three files from SquirrelTemp into the per-user Windows Startup folder (C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\): a legitimate G DATA antivirus updater (NOVUpdate.exe), a malicious DLL (avk.dll), and an encrypted data file (NOVUpdate.exe.dat). NOVUpdate.exe is then launched with a hidden window (WshShell Run window style 0). Placement in the Startup folder provides a non-privileged T1547.001 per-user persistence mechanism that re-executes the loader chain at every logon.
NOVUpdate.exe is a legitimately code-signed G DATA component that, on execution, resolves and loads avk.dll from its own working directory. In a benign deployment this would be the genuine G DATA library; here the attacker has substituted a trojanized DLL. This is classical DLL search order hijacking / side-loading (MITRE T1574.002). The malicious avk.dll acts as a PlugX loader that reads, XOR-decrypts, and maps the shellcode stored in the accompanying NOVUpdate.exe.dat file into memory — a signed-executable + trojanized-DLL + encrypted-payload triad that is the defining signature of the modern PlugX loader lineage.
Behavioural sandbox analysis confirmed that within 22 seconds of NOVUpdate.exe launching, the process established an outbound TCP connection to 8.217.190.58 on port 443. The destination IP resides inside an Alibaba Cloud–associated address range (8.217.0.0/16). The loader also modified the registry key HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, a path PlugX variants have historically touched to enumerate network configuration or stage persistence state.
The dropper applies explicit anti-forensic cleanup: after staging the payload it writes a small companion batch file (~del.vbs.bat) that waits two seconds, deletes the original Claude.vbs dropper, and then deletes itself. The dropper also creates a new clean Claude.lnk shortcut on the Desktop that points directly at the real claude.exe, leaving the victim with a working shortcut while the original Claude AI.lnk becomes a dead link. The entire malicious payload block is wrapped in an On Error Resume Next VBScript directive so any deployment failure is silently swallowed without raising a visible error dialog. The only on-disk artefacts remaining after first execution are the three sideloading files in the Startup folder and the live NOVUpdate.exe process.
The G DATA avk.dll sideloading triad technique reused here was publicly documented by Spanish threat intelligence firm Lab52 in February 2026 in their report "PlugX Meeting Invitation via MSBuild and GDATA," where the same three-file architecture was delivered via fake meeting-invitation phishing; the only material difference is the encrypted payload filename (Lab52 observed AVKTray.dat; this campaign uses NOVUpdate.exe.dat) and the lure theme. The rapid reuse of the technique with a fresh Claude-branded lure — weeks after public disclosure — indicates an operator with an operational playbook and fast lure-rotation capability.
PlugX has been tracked since at least 2008 and is historically associated with Chinese state-aligned espionage clusters, most prominently Mustang Panda (also tracked as TA416, BRONZE PRESIDENT, RedDelta, Earth Preta, Camaro Dragon, Stately Taurus, Twill Typhoon, HoneyMyte, Red Lich, and HIVE0154). However, PlugX source code has circulated in underground forums for years, meaning attribution based purely on tooling is not definitive. The operator behind this specific campaign is assessed with MEDIUM confidence as a PlugX-capable China-nexus cluster, consistent with Mustang Panda / Earth Preta tradecraft.
MITRE ATT&CK techniques used in TL-2026-0349
discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery
defense-evasion
T1036.001 Invalid Code Signature; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1564.003 Hidden Window
exfiltration
T1041 Exfiltration Over C2 Channel
collection
execution
T1059.005 Visual Basic; T1204.002 Malicious File; T1569.002 Service Execution
command-and-control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer; T1571 Non-Standard Port; T1573.002 Asymmetric Cryptography
defense-impairment
T1112 Modify Registry; T1553.002 Code Signing
initial-access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
persistence
T1547.001 Registry Run Keys / Startup Folder; T1574.001 DLL
resource-development
T1583 Acquire Infrastructure; T1583.001 Domains; T1583.006 Web Services; T1587.001 Malware; T1588.002 Tool; T1608.001 Upload Malware
Affected products and versions in Fake Claude AI Download Site Delivers Trojanized Installer
- Anthropic — Claude Desktop (impersonated)
Vulnerable versions: All — brand impersonation, no product flaw - Microsoft — Windows
Vulnerable versions: Windows 10 x64; Windows 11 x64 - G DATA — G DATA Antivirus Updater (NOVUpdate.exe)
Vulnerable versions: Abused as signed sideloading host — no product flaw
Remediation for Fake Claude AI Download Site Delivers Trojanized Installer
Immediate actions
- Block outbound traffic to 8.217.190.58 on all perimeter and endpoint firewalls
- Hunt for NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat in all user Startup folders (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\)
- Hunt for the misspelled install path C:\Program Files (x86)\Anthropic\Claude\Cluade\ across the estate
- Block downloads of Claude-Pro-windows-x64.zip by filename and hash at web proxy and email gateway
- Isolate any endpoint matching the IOCs and begin incident response — assume credential compromise
- Rotate credentials for any accounts used from affected endpoints; PlugX variants include keylogging and credential-theft modules
Workarounds
- Restrict VBScript / WScript execution enterprise-wide via software restriction policy where business need permits
- Require MSI installer execution only under managed software distribution channels (SCCM / Intune) — block direct user MSI execution from Downloads and temp directories
Longer-term hardening
- Deploy EDR with behavioural detection for DLL sideloading of signed third-party security tooling outside their canonical install paths
- Enforce application allowlisting (WDAC / AppLocker) to block execution of unsigned or unknown binaries from per-user Startup folders
- Block execution of .vbs scripts from Desktop shortcuts or user-writable locations via ASR rules (Microsoft Defender ASR: Block execution of potentially obfuscated scripts)
- Implement DNS / web filtering that blocks newly-registered domains and typosquats of high-value SaaS brands (anthropic, claude, openai, etc.)
- Educate developers and researchers on verifying AI tool downloads exclusively from vendor-authoritative URLs (claude.com/download)
- Deploy egress filtering with outbound TLS inspection where legally permitted to detect PlugX beacons to cloud VPS C2
Weaknesses (CWE) in Fake Claude AI Download Site Delivers Trojanized Installer
CWE-427, CWE-494, CWE-426
Timeline of Fake Claude AI Download Site Delivers Trojanized Installer
- PlugX remote access trojan first observed in the wild; subsequently tracked as a signature tool of China-aligned espionage clusters including Mustang Panda / Earth Preta.
- Lab52 publishes 'PlugX Meeting Invitation via MSBuild and GDATA' report documenting the G DATA NOVUpdate.exe + avk.dll + AVKTray.dat sideloading triad delivered via meeting-invitation phishing — the template later reused in this Claude campaign.
- Passive DNS telemetry last observes MX records for the fake Claude domain pointed to Kingmailer bulk-email infrastructure.
- Fake Claude domain MX records switch to CampaignLark bulk-email platform, indicating active operator maintenance and rotation of sending capability.
- Malwarebytes sandbox telemetry observes NOVUpdate.exe establishing outbound TCP to 8.217.190.58:443 within 22 seconds of launch, confirming live C2 callback behaviour.
- Threadlinqs Intelligence ingests the campaign as TL-2026-0349 for pipeline research, detection engineering, and simulation.
- Malwarebytes publishes public disclosure of the fake Claude site, trojanized Claude-Pro-windows-x64.zip installer, G DATA sideloading chain, and the Alibaba Cloud C2 IOC 8.217.190.58.
- As of 2026-05-29, this remains ACTIVE: Sophos X-Ops (May 7) confirmed the fake-Claude PlugX/DonutLoader chain ran for months (Feb-Apr 2026), revealed a new "Beagle" backdoor, and saw operators rotating lures, email infra and security-vendor impersonations. The Alibaba Cloud C2 (8.217.190.58) was chosen to resist takedown, no disruption/arrest reported, and infrastructure stays live.
Sources cited for Fake Claude AI Download Site Delivers Trojanized Installer
- Malwarebytes: Fake Claude site installs malware that gives attackers access to your computer
- Lab52: PlugX Meeting Invitation via MSBuild and GDATA
- MITRE ATT&CK G0129 — Mustang Panda
- MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading
- Malpedia: PlugX
- Malpedia: Mustang Panda
- The Hacker News: China-linked TA416 targets European governments with PlugX and OAuth-based phishing
- Darktrace: How PlugX Malware Has Evolved & Adapted
- MITRE ATT&CK C0047 — RedDelta Modified PlugX Infection Chain Operations
Threats related to Fake Claude AI Download Site Delivers Trojanized Installer
Detection coverage for TL-2026-0349
As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0349 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.