Fake Claude AI website is pushing a Windows backdoor through Google search results

[Redaktion]

A fake Claude AI website is pushing the Beagle Windows backdoor through Google sponsored search results using a trojanized Claude-Pro Relay installer that silently deploys a remote access tool.

https://www.notebookcheck.net/Fake-Claude-AI-website-is-pushing-a-Windows-backdoor-through-Google-search-results.1291664.0.html

[Areeb]

Areeb from CampaignLark here.

We recently noticed this article and wanted to clarify that it is not accurate to say the scammers "switched to CampaignLark," as that wording could imply that we knowingly accepted or deliberately allowed them to use our platform.

On 5th April, we had a registration from [email protected] (2602:fbf1:b001::139) who created a workspace called "claude pro" on our platform, added their domain and tried sending an email campaign about Claude Code CLI.

However, our spam filter immediately detected and no more than two or three emails were sent from our platform. The account was disabled right after their bulk campaign was flagged.

We also have a chat transcript with the operators:

Hillmannyezenia: I wonder why my account was suspended
Hillmannyezenia: [email protected]
CampaignLark: We reviewed your campaign and unfortunately, we can't approve your account/workspace at this time. We recommend looking for a different email marketing platform that may meet your requirements.
Hillmannyezenia: I wonder why
Hillmannyezenia: which policy I violate
CampaignLark: I understand, but we don't usually disclose that information.