Fake Claude AI Site Drops PlugX RAT

Cyber Threat Intelligence recently reported a classic move by threat actors: leveraging the popularity of new tech to distribute malware. In this instance, a fake Claude AI website is being used as a vector to push the notorious PlugX Remote Access Trojan (RAT). This isn’t groundbreaking, but it’s a persistent and effective tactic that preys on users’ desire for quick access to trending tools.

The deployment method involves users unknowingly downloading the PlugX RAT, disguised as legitimate software from the fraudulent Claude site. PlugX is a well-known RAT, giving attackers extensive control over compromised systems, including data exfiltration, keystroke logging, and remote execution of commands. It’s a nasty piece of kit that’s been around for ages, and its continued use highlights its efficacy in the hands of various threat groups, from state-sponsored actors to common cybercriminals.