TLDR Tech / InfoSec
Fake Claude Website Distributes PlugX RAT
A threat actor set up a typosquatted Anthropic domain serving a trojanized MSI installer that silently deploys PlugX alongside the legitimate Claude application via DLL sideloading via a signed G DATA binary (NOVUpdate.exe), and beacons to C2 infrastructure on Alibaba Cloud. The VBScript dropper persists in the startup folder and self-deletes to minimize forensic artifacts, while error suppression prevents victim-visible alerts during deployment. Block unsigned DLL loads from startup directories, hunt for NOVUpdate.exe spawning network connections, and enforce application allowlisting to prevent trojanized AI tool installers from executing.
Read the full story