Fake Claude site installs malware that gives attackers access to your computer

EXECUTIVE SUMMARY:

Attackers target Claude's rapid growth, with nearly 290 million web visits per month, by creating a fake website impersonating Anthropic's Claude. The domain mimics Claude's official site, and visitors who download the ZIP archive receive a copy of Claude that installs and runs as expected. However, in the background, it deploys a PlugX malware chain that gives attackers remote access to the system. The ZIP contains an MSI installer that installs to a path designed to mimic a legitimate Anthropic installation.[emaillocker id="1283"]

The installer places a shortcut on the Desktop pointing to a VBScript dropper, which locates the real application and runs it in the foreground. The dropper then creates a new shortcut pointing directly to the real application, leaving the victim with a working shortcut going forward. The malicious DLL (PlugX loader) is delivered through a malicious file, and the encrypted payload is transferred over a C2 channel.

The campaign shows a convincing fake Claude site serving PlugX malware. The attackers maintain and rotate their sending capability, using two commercial bulk-email platforms. The campaign's scale and regions are not specified, but it highlights the importance of monitoring for similar threats in the future.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer