Tracked topic
Claude is an AI assistant developed by Anthropic that uses large language models to generate text and support conversational tasks.
The base64 instructions shown in the shared Claude chat download an encoded shell script from domains such as: In variant seen by Albayrak [VirusTotal]: hxxp://customroofingcontractors[.]com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e In variant seen by BleepingComputer [VirusTotal]: hxxps://bernasibutuwqu2[.]com/debug/loader.sh?build=a39427f9d5bfda11277f1a58c89b7c2d The 'loader.sh' (served by the second link above) is another set of Gunzip-compressed shell instructions: Base64 code retrieves first stage 'loader.sh' payload (BleepingComputer) This compressed shell
Hackers abuse Google ads, Claude.ai chats to push Mac malwareFake Claude AI website delivers new 'Beagle' Windows malware By Bill Toulas May 7, 2026 06:02 AM A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle. …
Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac.
["claude-mythos"]
… An embedded PDB path also references the Windows account name 'Mero' and contains 'claude,' potentially indicating that AI was used to assist in developing the Windows malware. …
… Once an infection occurs, the malware writes itself into Claude Code hooks and VS Code auto-run tasks, so uninstalling the malicious packages does not remove it. …
… On the second day , the competitors will also attempt to exploit zero-days in Microsoft SharePoint, Microsoft Exchange, Windows 11, Apple Safari, Cursor, Red Hat Enterprise Linux for Workstations, LM Studio, OpenAI Codex, LiteLLM, Anthropic Claude Code, and Mozilla Firefox. …
… Download Now Related Articles: New stealthy Quasar Linux malware targets software developers New GopherWhisper APT group abuses Outlook, Slack, Discord for comms JDownloader site hacked to replace installers with Python RAT malware Fake Claude AI website delivers new 'Beagle' Windows malware Threat… …
… Security researchers say the malware also established persistence on developer systems by modifying Claude Code hooks and VS Code auto-run tasks, enabling it to survive package removal. …