Beagle

The campaign appears to be spreading through malvertising, where attackers pay to place malicious links in search engine ads and sponsored results.

Cybercriminals have launched a sophisticated malvertising campaign using a fake Claude‑AI website... The deceptive site, reachable through sponsored search results, mimics Anthropic’s legitimate Claude interface and lures users into downloading what appears to be a productivity‑oriented “Claude‑Pro Relay” tool but is in fact a poisoned installer.

Threat actors may have also used SEO poisoning to further boost the site’s visibility in organic search results.

Through this connection, an attacker can upload and download files, run commands, manage directories, and maintain persistent access on the compromised machine.

It supports a small set of commands such as running arbitrary shell commands...

While the legitimate application runs in the foreground, the VBScript quietly copies three files from the SquirrelTemp directory into the Windows Startup folder.

Users who bypass standard security hygiene—such as verifying the URL or ignoring suspicious “sponsored” tags—end up deploying this bundle on their machines.

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll.

Once the MSI executes, it drops three files into the Windows Startup folder: NOVupdate.exe, NOVupdate.exe.dat, and a malicious DLL named avk.dll.

Sophos found other samples from February and April. Further investigation revealed that hackers reused the same XOR key across different Donut samples throughout the year.

The malicious domain claude‑pro[.]com presents a stripped‑down clone of the official Claude design, using similar colors and fonts to create a veneer of legitimacy.

It supports a small set of commands such as ... uninstalling itself to destroy evidence.

Victims are kept in the dark, because after deploying the payload files, the VBScript writes a small batch file called ~del.vbs.bat that waits two seconds, then deletes both the original VBScript and the batch file itself.

The malicious DLL decrypts the payload hidden inside NOVupdate.exe.dat using a hardcoded XOR key and runs the result entirely in memory.

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

This DLL decrypts the encrypted data file, then executes the open‑source in‑memory loader DonutLoader, which in turn deploys the final payload—the Beagle backdoor—entirely in memory to evade disk‑based detection.

It supports a small set of commands such as ... creating and renaming directories, listing folder contents...

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

The malware communicates with its command‑and‑control server at license[.]claude‑pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key to make network monitoring more difficult.

The backdoor communicates with the command-and-control (C2) server... over TCP (443) and/or UDP (8080).

It supports a small set of commands such as running arbitrary shell commands, uploading and downloading files...

The malware communicates with its command‑and‑control server at license[.]claude‑pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key to make network monitoring more difficult.