Malvertising campaign using a fake Claude site distributes an MSI that sideloads a signed G DATA updater to deploy DonutLoader and the new Beagle backdoor.
Part of the PlainSec briefing for 2026-05-07