MalwarePublished 13 Apr 2026

Fake Claude Website Distributes PlugX RAT

Source SecurityWeek

Description

The malware mimics the legitimate Anthropic installation, relies on DLL sideloading, and cleans up after itself. The post Fake Claude Website Distributes PlugX RAT appeared first on SecurityWeek .

Impact

If successful, the PlugX RAT can provide attackers with remote access to compromised systems, potentially allowing data theft, system manipulation, or further malware deployment. The use of DLL sideloading and cleanup techniques complicates detection and incident response. However, no active exploitation or widespread incidents have been confirmed based on the available information.

Defensive guidance

Mitigation should focus on user awareness to avoid fake websites impersonating legitimate services and on endpoint protection capable of detecting PlugX RAT and DLL sideloading behaviors. Network and web filtering to block access to known malicious sites may also help reduce risk.

Summary

This threat involves a malicious website that mimics the official Anthropic Claude installation site to trick users into downloading malware. The delivered malware is the PlugX RAT, which employs DLL sideloading to evade detection and maintain persistence. After execution, the malware cleans up artifacts to reduce forensic evidence. There is no indication of affected software versions or known exploits in the wild from the provided data.

References

securityweek.com/fake-claude-website-distributes-plugx-rat/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Apr 2026, 10:02 UTC

References

Community reviews

Related threats