Fake Claude site installs malware that gives attackers access to your computer

Keypoints

• Attackers created a convincing fake Claude download page offering “Claude-Pro-windows-x64.zip” that installs a working app while also deploying malware.
• The ZIP contains an MSI that installs to a misspelled path (C:Program Files (x86)AnthropicClaudeCluade), a deliberate red flag that mimics a legitimate Anthropic install.
• A VBScript dropper launches the real claude.exe in the foreground while copying NOVUpdate.exe, avk.dll, and NOVUpdate.exe.dat to the user Startup folder for persistence.
• The campaign uses DLL sideloading (MITRE T1574.002) by running a signed G DATA updater (NOVUpdate.exe) that loads a malicious avk.dll to decrypt and execute the PlugX payload.
• Sandbox telemetry showed NOVUpdate.exe connecting to 8.217.190.58:443 within 22 seconds of execution and modifying TCP/IP-related registry keys.
• The dropper cleans up after itself by creating a batch that deletes the VBScript and itself, leaving only the sideloading components and running NOVUpdate.exe as artifacts.
• This technique closely follows a playbook publicly documented weeks earlier and illustrates rapid reuse of known sideloading methods with a timely AI-related lure.