Fake Claude Website Distributes PlugX RAT, Posing Cybersecurity Threat
A fake website posing as a legitimate Anthropic Claude domain has been distributing the PlugX remote access trojan (RAT) to unsuspecting users. The site offers a download link for a ZIP archive, which contains an MSI installer mimicking the legitimate Claude application. Upon installation, a VBScript dropper runs the real app while installing malware in the background. The PlugX RAT, known for its use in espionage campaigns, establishes a connection to its command-and-control infrastructure, allowing attackers to gain unauthorized access to infected systems.