Beware of Fake Claude Web. Trick Download Pro Version

Beware of fake Claude web. Trick-download pro version. Actually, it's PlugX malware.

In recent times, the name of the strongest artificial intelligence or AI has been inevitable, Claude. From the drama with the United States government to the fact that the source code was stolen by employee negligence, there are many hackers on the stream unless this is the case.

A report from the Security Affair website mentioned the detection of Claude's fake website, a famous AI tool developed by Anthropic. These fake websites deceive victims that Claude has been distributed in a version for high-end use or a free Pro Version, but it is actually a malware type that remotely controls the machine, or a RAT (Remote Access Trojan) called PlugX. The file that tricked the victim into downloading is a zip-based compressed file that, when unpacked, inside is a file for the installation of the MSI extension similar to the real Claude installer. There is a slight misspelling with a shortcut file that can lead to running a VBS malware script that, when pressed on it, leads to running an application to disguise the true behavior to look unsuspicious.

But behind this is the running of the script. The script will copy three files: NOVUpdate.exe, avk.dll, and an encrypted .dat file called NOVUpdate.exe.dat to the Windows Startup folder and then quietly run a malware run (payload) from the avk.dll file with the DLL technique of running the DLL file into the system itself, or DLL Sideloading, in which the DLL file decrypts the Dat file into a malware payload. PlugX is embedded on the machine.

After the malware is embedded into the machine, the malware will immediately contact the Command and Control or C2 server located on IP number 8.217.190 [.] 58 through the HTTP protocol. In addition, the malware has only established the TCP / IP Registry Key to modify the behavior of network contact. In addition, to prevent detection, the script that installs the malware when it is fully installed will delete itself, along with a Batch script file called ~ del.vbs. bat to defuse traces of itself that used to run on the machine.

PlugX was originally an Espionage spying malware of a group of hackers working for the Chinese government, but the source code of this malware was later leaked to the public, leading to the sale of this malware along underground web boards and the black market, so that it is difficult to clearly identify the criminal group behind this campaign.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Claude # freedomhack