A fraudulent imitation of Anthropic's Claude website has been used to distribute a previously undocumented backdoor named Beagle, deployed through a Dynamic Link Library (DLL) sideloading chain that abuses a signed antivirus updater binary. The malicious domain claude-pro[.]com presents a stripped-down imitation of the legitimate Claude interface and offers a fictitious tool called Claude-Pro Relay, served as an approximately 505 MB ZIP archive, according to new analysis by Sophos X-Ops. The researchers assessed that the site is part of an active malvertising campaign and traced the hosting infrastructure to a server set up in March 2026. PlugX-Style Chain Leads to Different Payload The downloaded archive contains an MSI installer that drops three files into the user's startup folder: a…