Threats · 131 days ago

G DATA antivirus updater security update

Malvertising campaign using a fake Claude site distributes an MSI that sideloads a signed G DATA updater to deploy DonutLoader and the new Beagle backdoor.

Timeline

• May 7 Reported by Infosecurity Magazine

Sources

2 sources covering this story

• Infosecurity Magazine May 7

  Fake Claude AI Site Drops Beagle Backdoor on Windows Users

  Sophos finds fake Claude site spreading DonutLoader and a new Beagle backdoor via DLL sideloading

• BleepingComputer May 7

  Fake Claude AI website delivers new 'Beagle' Windows malware

  A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle.

Part of the PlainSec briefing for 2026-05-07

Editions

• Briefing for 2026-05-07

Related stories

• PyPI Malware Hides C2 Inside Zulip Traffic
• ScarCruft Moves BirdCall From Windows to Android
• Karakurt Used State Ties to Raise Ransom Pressure