A fraudulent website impersonating Anthropic's Claude (claude-pro[.]com) distributes a 505MB 'Claude-Pro Relay' ZIP that contains a trojanized MSI. The installer drops a signed G DATA updater (renamed NOVupdate.exe), an encrypted data file and avk.dll; the updater sideloads avk.dll, which decrypts and runs shellcode that loads DonutLoader and deploys a previously undocumented Beagle backdoor. Malwarebytes initially discovered the campaign and Sophos X-Ops provided technical analysis.
Part of the PlainSec briefing for 2026-05-07