Fake Claude “Pro” Installer Spreads PlugX Malware via Sophisticated DLL Sideloading Attack

CyberDefender 7 mins0

The rapid rise of Anthropic’s Claude—now attracting nearly 290 million monthly visits—has made it a prime target for cybercriminals. In a recent campaign, attackers exploited this popularity by creating a convincing fake download site that delivers a fully functional application bundled with hidden malware.

The Deceptive Setup

At first glance, the malicious website appears legitimate, offering a “Pro” version of Claude via a downloadable ZIP file named Claude-Pro-windows-x64.zip. The domain infrastructure even includes active email delivery systems, rotating between bulk mailing services—suggesting a well-maintained phishing operation. Once downloaded, the installer behaves exactly as expected. It installs Claude into a directory resembling a legitimate path:

C:\Program Files (x86)\Anthropic\Claude\Cluade\

However, the subtle typo “Cluade” is a critical red flag. This minor detail is often overlooked, allowing attackers to maintain the illusion of authenticity.

Behind the Scenes: Malware Deployment

While users interact with a seemingly normal application, a hidden execution chain begins. A VBScript dropper launches the real app to avoid suspicion but simultaneously deploys malicious components into the Windows Startup folder.

Three key files are planted:

  • NOVUpdate.exe – a legitimate G DATA antivirus updater
  • avk.dll – a malicious DLL
  • NOVUpdate.exe.dat – an encrypted payload

This setup enables a DLL sideloading attack, where a trusted executable loads a malicious library. The technique (MITRE T1574.002) is particularly dangerous because security tools often trust signed binaries like NOVUpdate.exe.

The malicious DLL decrypts and executes the payload—identified as part of the PlugX malware family, a long-standing remote access trojan used in cyber-espionage operations.

Rapid Network Activity and Persistence

Within seconds of execution, the malware establishes outbound communication with a command-and-control (C2) server: 8.217.190.58:443

This IP is hosted on Alibaba Cloud infrastructure, a common tactic used by attackers to blend malicious traffic with legitimate cloud services.

Additionally, the malware modifies system registry keys related to network configuration and ensures persistence by placing itself in the Startup directory.

Anti-Forensics Techniques

To evade detection, the dropper removes itself shortly after execution. It creates a temporary batch script that deletes both the VBScript and itself, leaving minimal traces behind. It also suppresses errors using On Error Resume Next, ensuring no visible alerts are shown to the victim.

A Familiar Technique with a New Twist

This campaign mirrors earlier PlugX attacks documented in 2026, where similar sideloading techniques were used with different lures. The only change here is the delivery method—leveraging the growing popularity of AI tools.

This highlights a key trend: attackers rapidly adapt proven techniques to new, trending targets.

Indicators of Compromise (IOCs)

Users should immediately investigate if they find:

  • Files: NOVUpdate.exe, avk.dll, NOVUpdate.exe.dat
  • Suspicious install path with “Cluade”
  • Network traffic to 8.217.190.58
  • Unknown startup entries

How to Stay Safe

  • Only download Claude from its official source
  • Avoid “Pro” versions from ads or emails
  • Use updated anti-malware solutions
  • Monitor startup folders and network traffic
  • Change passwords if infection is suspected

Our Opinion: Why This Attack Matters

This campaign is a clear example of how cybercriminals are evolving faster than many users—and even organizations—can keep up with. What makes this attack particularly dangerous is not the malware itself, but the psychological precision behind it. By leveraging a trusted and rapidly growing AI product, attackers bypass traditional skepticism. Users expect innovation and new features, so a “Pro version” doesn’t immediately raise suspicion.

Another concerning aspect is the use of legitimate, signed software (like G DATA’s updater) in the attack chain. This blurs the line between safe and malicious activity, making detection significantly harder even for advanced security tools. It’s no longer just about avoiding suspicious files—it’s about verifying everything, even what looks authentic.

We also see a shift toward speed. Techniques documented just weeks earlier are already being reused in active campaigns. This suggests a highly agile threat ecosystem where attackers share and deploy methods almost instantly.

Ultimately, this incident reinforces a critical lesson: trust must be earned, not assumed—even in the age of AI. As AI adoption grows, so will the sophistication of threats exploiting it.

CyberDefender