Fake Claude Websites Hide Risks: Downloading Clients May Install Remote Control Backdoor

Recently, security firm Sophos found that hackers are spreading fake Claude websites through search engine paid rankings to attract users. These sites claim to offer a 'Claude-Pro Relay' professional client download, luring users to click.

After clicking download, users will get a 505MB compressed file. Executing the installer will implant the new Beagle backdoor, which has full remote control capabilities—able to execute attacker commands, transfer files, and even collect privacy information long-term.

Researchers also found that Cloudflare origin credentials accidentally leaked by hackers show the fake website was set up as early as March this year, but only exposed recently.