# Fake Claude AI Download Site Delivers Trojanized Installer Deploying PlugX RAT via G DATA DLL Sideloading

> A fake Anthropic Claude download site distributes a trojanized Windows installer (Claude-Pro-windows-x64.zip) that installs a working copy of Claude while silently deploying a PlugX RAT chain using a legitimate signed G DATA antivirus updater (NOVUpdate.exe) to sideload a malicious avk.dll, decrypting an XOR payload from NOVUpdate.exe.dat and beaconing to Alibaba Cloud C2 8.217.190.58:443 within 22 seconds of execution. The campaign reuses a G DATA DLL sideloading triad technique publicly documented by Lab52 in February 2026 and is historically associated with Chinese state-aligned PlugX operators (Mustang Panda / Earth Preta cluster).

- **Published:** 2026-04-10T12:00:00Z
- **Last reviewed:** 2026-04-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0349
- **ID:** TL-2026-0349
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Earth Preta cluster (China)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On April 10, 2026, Malwarebytes threat researcher Stefan Dasic disclosed an active malware distribution campaign leveraging a fake Anthropic Claude download website to deliver a trojanized installer that installs a functional copy of Claude while simultaneously deploying a PlugX remote access trojan (RAT) chain on the victim endpoint. The campaign exploits the surging popularity of AI desktop tooling (Claude receives approximately 290 million monthly web visits) as a social engineering lure targeting developers, security researchers, and enterprise knowledge workers.

The fake site presents itself as an official Anthropic download page for a fictional Claude Pro Windows build and serves a ZIP archive named Claude-Pro-windows-x64.zip. Passive DNS telemetry shows the impersonating domain has been equipped with active bulk-email infrastructure, with MX records rotating between two commercial bulk-email providers — Kingmailer (last observed March 28, 2026) and CampaignLark (observed from April 5, 2026) — indicating operator maintenance of a sending capability suitable for phishing distribution in addition to web-based drive-by or search-ad delivery.

The archive contains an MSI installer that deploys files under C:\Program Files (x86)\Anthropic\Claude\Cluade\ — a deliberate typosquat of the legitimate path that mirrors the Squirrel update framework layout used by real Electron-based Anthropic Claude installers. The installer drops a lure LNK (Claude AI.lnk) on the user Desktop pointing at Claude.vbs inside a SquirrelTemp subdirectory. When the victim clicks the Desktop shortcut, the VBScript dropper locates the genuine claude.exe two directory levels above SquirrelTemp and launches it in the foreground, providing the victim with a fully working Claude application.

With the legitimate application running as cover, the VBScript copies three files from SquirrelTemp into the per-user Windows Startup folder (C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\): a legitimate G DATA antivirus updater (NOVUpdate.exe), a malicious DLL (avk.dll), and an encrypted data file (NOVUpdate.exe.dat). NOVUpdate.exe is then launched with a hidden window (WshShell Run window style 0). Placement in the Startup folder provides a non-privileged T1547.001 per-user persistence mechanism that re-executes the loader chain at every logon.

NOVUpdate.exe is a legitimately code-signed G DATA component that, on execution, resolves and loads avk.dll from its own working directory. In a benign deployment this would be the genuine G DATA library; here the attacker has substituted a trojanized DLL. This is classical DLL search order hijacking / side-loading (MITRE T1574.002). The malicious avk.dll acts as a PlugX loader that reads, XOR-decrypts, and maps the shellcode stored in the accompanying NOVUpdate.exe.dat file into memory — a signed-executable + trojanized-DLL + encrypted-payload triad that is the defining signature of the modern PlugX loader lineage.

Behavioural sandbox analysis confirmed that within 22 seconds of NOVUpdate.exe launching, the process established an outbound TCP connection to 8.217.190.58 on port 443. The destination IP resides inside an Alibaba Cloud–associated address range (8.217.0.0/16). The loader also modified the registry key HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, a path PlugX variants have historically touched to enumerate network configuration or stage persistence state.

The dropper applies explicit anti-forensic cleanup: after staging the payload it writes a small companion batch file (~del.vbs.bat) that waits two seconds, deletes the original Claude.vbs dropper, and then deletes itself. The dropper also creates a new clean Claude.lnk shortcut on the Desktop that points directly at the real claude.exe, leaving the victim with a working shortcut while the original Claude AI.lnk becomes a dead link. The entire malicious payload block is wrapped in an On Error Resume Next VBScript directive so any deployment failure is silently swallowed without raising a visible error dialog. The only on-disk artefacts remaining after first execution are the three sideloading files in the Startup folder and the live NOVUpdate.exe process.

The G DATA avk.dll sideloading triad technique reused here was publicly documented by Spanish threat intelligence firm Lab52 in February 2026 in their report "PlugX Meeting Invitation via MSBuild and GDATA," where the same three-file architecture was delivered via fake meeting-invitation phishing; the only material difference is the encrypted payload filename (Lab52 observed AVKTray.dat; this campaign uses NOVUpdate.exe.dat) and the lure theme. The rapid reuse of the technique with a fresh Claude-branded lure — weeks after public disclosure — indicates an operator with an operational playbook and fast lure-rotation capability.

PlugX has been tracked since at least 2008 and is historically associated with Chinese state-aligned espionage clusters, most prominently Mustang Panda (also tracked as TA416, BRONZE PRESIDENT, RedDelta, Earth Preta, Camaro Dragon, Stately Taurus, Twill Typhoon, HoneyMyte, Red Lich, and HIVE0154). However, PlugX source code has circulated in underground forums for years, meaning attribution based purely on tooling is not definitive. The operator behind this specific campaign is assessed with MEDIUM confidence as a PlugX-capable China-nexus cluster, consistent with Mustang Panda / Earth Preta tradecraft.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Domains
- T1583.006 Web Services
- T1588.002 Tool
- T1608.001 Upload Malware
- T1587.001 Malware
- T1189 Drive-by Compromise
- T1566.002 Spearphishing Link
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1569.002 Service Execution
- T1547.001 Registry Run Keys / Startup Folder
- T1574.001 DLL
- T1036.005 Match Legitimate Resource Name or Location
- T1036.001 Invalid Code Signature
- T1070.004 File Deletion
- T1140 Deobfuscate/Decode Files or Information
- T1564.003 Hidden Window
- T1553.002 Code Signing
- T1112 Modify Registry
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1056.001 Keylogging
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1105 Ingress Tool Transfer
- T1571 Non-Standard Port
- T1041 Exfiltration Over C2 Channel

## Sources

- [Malwarebytes: Fake Claude site installs malware that gives attackers access to your computer](https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer)
- [Lab52: PlugX Meeting Invitation via MSBuild and GDATA](https://lab52.io/blog/mustang-panda-recent-activity-dll-sideloading-trojans-with-temporal-c2-servers/)
- [MITRE ATT&CK G0129 — Mustang Panda](https://attack.mitre.org/groups/G0129/)
- [MITRE ATT&CK T1574.002 — Hijack Execution Flow: DLL Side-Loading](https://attack.mitre.org/techniques/T1574/002/)
- [Malpedia: PlugX](https://malpedia.caad.fkie.fraunhofer.de/details/win.plugx)
- [Malpedia: Mustang Panda](https://malpedia.caad.fkie.fraunhofer.de/actor/mustang_panda)
- [The Hacker News: China-linked TA416 targets European governments with PlugX and OAuth-based phishing](https://thehackernews.com/2026/04/china-linked-ta416-targets-european.html)
- [Darktrace: How PlugX Malware Has Evolved & Adapted](https://www.darktrace.com/blog/plugx-malware-a-rats-race-to-adapt-and-survive)
- [MITRE ATT&CK C0047 — RedDelta Modified PlugX Infection Chain Operations](https://attack.mitre.org/campaigns/C0047/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0349