Beagle

The campaign appears to be spreading through malvertising, where attackers pay to place malicious links in search engine ads and sponsored results.

Cybercriminals have launched a sophisticated malvertising campaign using a fake Claude‑AI website... The deceptive site, reachable through sponsored search results, mimics Anthropic’s legitimate Claude interface and lures users into downloading what appears to be a productivity‑oriented “Claude‑Pro Relay” tool but is in fact a poisoned installer.

Threat actors may have also used SEO poisoning to further boost the site’s visibility in organic search results.

operators left a staging server open with tools, command history, and phishing packages ready... used fake Claude software themes to lure victims into opening staged packages.

Through this connection, an attacker can upload and download files, run commands, manage directories, and maintain persistent access on the compromised machine.

It supports a small set of commands such as running arbitrary shell commands...

While the legitimate application runs in the foreground, the VBScript quietly copies three files from the SquirrelTemp directory into the Windows Startup folder.

Users who bypass standard security hygiene—such as verifying the URL or ignoring suspicious “sponsored” tags—end up deploying this bundle on their machines.

TriBack Loader , triggered via DLL sideloading that decrypts and executes shellcode payloads

The VBS stager is similar, but this time drops all the payloads into the startup directory for persistence.

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

The VBS stager is similar, but this time drops all the payloads into the startup directory for persistence.

Sophos found other samples from February and April. Further investigation revealed that hackers reused the same XOR key across different Donut samples throughout the year.

used fake Claude software themes... one posing as a Venezuelan municipal tax system... signed vendor binaries that launch from user writable paths

It decrypts and runs shellcode using everyday Windows callback functions... A third path used shellcode to run Beagle

It supports a small set of commands such as ... uninstalling itself to destroy evidence.

Victims are kept in the dark, because after deploying the payload files, the VBScript writes a small batch file called ~del.vbs.bat that waits two seconds, then deletes both the original VBScript and the batch file itself.

The malicious DLL decrypts the payload hidden inside NOVupdate.exe.dat using a hardcoded XOR key and runs the result entirely in memory.

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

TriBack Loader , triggered via DLL sideloading that decrypts and executes shellcode payloads

This DLL decrypts the encrypted data file, then executes the open‑source in‑memory loader DonutLoader, which in turn deploys the final payload—the Beagle backdoor—entirely in memory to evade disk‑based detection.

It supports a small set of commands such as ... creating and renaming directories, listing folder contents...

They also used anti-analysis methods, which suggests a “codebase continuity rather than a short-lived ‘smash-and-grab’ campaign.”

The operation used the newly identified TriBack Loader with DLL sideloading and Win32 callback APIs to evade detection, delivering AdaptixC2 and Beagle backdoors.

HTTP C2 for AdaptixC2

The backdoor communicates with the command-and-control (C2) server... over TCP (443) and/or UDP (8080).

It supports a small set of commands such as running arbitrary shell commands, uploading and downloading files...

The malware communicates with its command‑and‑control server at license[.]claude‑pro[.]com over TCP port 443 or UDP port 8080, encrypting traffic with a hardcoded AES key to make network monitoring more difficult.