Beagle Backdoor Distributed via Fake Claude Site | MSSP Advisory

A fake Claude AI website is distributing the Beagle backdoor through DonutLoader malware using DLL sideloading techniques. The campaign targets Windows users who search for Claude AI and land on the fraudulent site instead of the legitimate Anthropic domain. Sophos discovered this supply chain attack that exploits user trust in AI tools to deliver persistent remote access malware.

Your clients are actively seeking AI tools right now, making them prime targets for this fake site campaign that bypasses traditional email security controls. If your RMM or remote access tools get compromised through this backdoor, attackers gain entry to every client network you manage. Your clients expect you to know when legitimate software brands are being weaponized against them.

📬