The base64 instructions shown in the shared Claude chat download an encoded shell script from domains such as: In variant seen by Albayrak [VirusTotal]: hxxp://customroofingcontractors[.]com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e In variant seen by BleepingComputer [VirusTotal]: hxxps://bernasibutuwqu2[.]com/debug/loader.sh?build=a39427f9d5bfda11277f1a58c89b7c2d The 'loader.sh' (served by the second link above) is another set of Gunzip-compressed shell instructions: Base64 code retrieves first stage 'loader.sh' payload (BleepingComputer) This compressed shell
Hackers abuse Google ads, Claude.ai chats to push Mac malware… "A Claude Code release included some internal source code. No sensitive customer data or credentials were involved or exposed," an Anthropic spokesperson told Bleepingcomputer . …
… In a statement to BleepingComputer, Anthropic says it's doing what it can to make sure this is a one-time occurrence: "Earlier today, a Claude Code release included some internal source code. …
A fake Claude AI website is pushing a new Windows backdoor through Google sponsored search results. The malicious domain, claude-pro . com, dresses itself up as the real Claude interface and offers a fake tool called Claude-Pro Relay. …
Fake Claude AI website delivers new 'Beagle' Windows malware By Bill Toulas May 7, 2026 06:02 AM A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle. …
Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for "Claude mac download" may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac.
bleepingcomputer.com
