Enterprise adoption of artificial intelligence tools has created a new attack vector for cybercriminals, who are now leveraging fake AI platforms to distribute sophisticated malware. Security researchers have uncovered a campaign that uses fraudulent Claude AI websites to deliver a previously unknown Windows backdoor dubbed 'Beagle,' demonstrating how threat actors are adapting their tactics to exploit organizations' rush to implement AI solutions.
The Deception: AI Tool as Trojan Horse
The attack begins with a convincing replica of the legitimate Claude AI website, complete with matching color schemes and typography. Victims are directed to a fraudulent domain hosting what appears to be a professional AI development tool called "Claude-Pro Relay," marketed as a high-performance service for developers working with Claude-Code applications.
The fake platform offers a single point of engagement: a prominent download button that delivers a 505MB archive containing what appears to be a legitimate installer. This social engineering approach capitalizes on the current enterprise trend of rapidly adopting AI tools, often without comprehensive security vetting processes.
Multi-Stage Payload Delivery
Once executed, the malicious installer demonstrates sophisticated evasion techniques through a multi-layered deployment process:
The campaign employs DonutLoader, an open-source in-memory injector, as an intermediate stage before deploying the final Beagle backdoor. This approach mirrors tactics previously observed in government-targeted operations across Southeast Asia, suggesting potential knowledge sharing or operator overlap between campaigns.
Beagle Backdoor Capabilities
The newly identified Beagle malware represents a streamlined but effective remote access tool. Unlike its namesake—a Delphi-based worm from 2004—this modern iteration focuses on core command-and-control functions:
The backdoor provides attackers with essential system control capabilities including command execution, file manipulation, directory operations, and complete agent management, all while maintaining encrypted communications with command servers.
Communication with the control infrastructure occurs through both TCP port 443 and UDP port 8080, with AES encryption protecting all data exchanges. The command server operates from cloud infrastructure, specifically utilizing Alibaba Cloud services to host the malicious domain.
Attribution and Campaign Scope
Analysis reveals this campaign extends beyond the Claude AI impersonation, with threat actors creating fake update portals for multiple major security vendors including CrowdStrike, SentinelOne, and Trellix. This broad approach suggests a well-resourced operation targeting the cybersecurity ecosystem itself.
While definitive attribution remains elusive, the technical similarities to known PlugX operations indicate potential experimentation by established threat actors with new payload delivery mechanisms. The consistent use of identical XOR decryption keys across samples submitted between February and April suggests coordinated development and deployment.
What You Should Do
Organizations can protect themselves against this type of attack through several defensive measures:
- Source Verification: Always download AI tools and software directly from official vendor websites, avoiding search engine advertisements or third-party download sites
- Network Monitoring: Implement monitoring for unusual outbound connections, particularly to cloud infrastructure hosting suspicious domains
- Endpoint Detection: Deploy solutions capable of identifying in-memory payload execution and DLL sideloading techniques
- User Education: Train staff to recognize sophisticated impersonation attempts, especially for trending technology categories like AI tools
Security teams should also monitor for the presence of 'NOVupdate' files in system environments, as these serve as strong indicators of compromise for this specific campaign.
As enterprises continue embracing AI technologies, cybercriminals will undoubtedly refine their approaches to exploit this adoption. The Beagle campaign demonstrates that even security-conscious organizations remain vulnerable when attackers successfully mimic legitimate tools and services that businesses actively seek to implement.
