Fake Claude Site Delivers PlugX Malware via Trojanized App

Cyber Threat Intelligence has uncovered a sophisticated phishing operation masquerading as a legitimate Claude AI download. Threat actors have created a convincing fake website designed to trick users into downloading a trojanized version of the Claude application. This malicious installer, upon execution, not only installs the fake Claude app but also quietly deploys the notorious PlugX malware onto the victim’s system.

PlugX is a potent remote access trojan (RAT) that has been a staple in the cyber-espionage toolkit for years. Its ability to grant attackers deep access and control over compromised systems makes it a significant threat. The deployment via a seemingly legitimate AI application download highlights the evolving tactics used to bypass user vigilance and security controls. This attack chain leverages social engineering and deceptive software distribution to achieve its objectives, underscoring the need for extreme caution when downloading software, even from sites that appear credible.