Threats & Adversaries · Web App Attack

G DATA antivirus updater security update

Malvertising campaign using a fake Claude site distributes an MSI that sideloads a signed G DATA updater to deploy DonutLoader and the new Beagle backdoor.

2 sources · May 7

Timeline

• May 7 Reported by Infosecurity Magazine

Sources

• May 7 Infosecurity Magazine

  Fake Claude AI Site Drops Beagle Backdoor on Windows Users

  Sophos finds fake Claude site spreading DonutLoader and a new Beagle backdoor via DLL sideloading

  original

• May 7 BleepingComputer

  Fake Claude AI website delivers new 'Beagle' Windows malware

  A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle.

  original

Part of the PlainSec briefing for 2026-05-07

Every edition of this story: G DATA antivirus updater security update

More from today

• PyPI Malware Hides C2 Inside Zulip Traffic
• ScarCruft Moves BirdCall From Windows to Android
• Karakurt Used State Ties to Raise Ransom Pressure