Fake Claude AI website is delivering a brand-new Windows malware called 'Beagle' to people searching for the chatbot

BleepingComputer reports a fake Claude AI website is delivering a previously undocumented Windows malware called Beagle. The site impersonates Anthropic's Claude with a near-perfect clone of the official UI; visitors who click 'Download for Windows' get a Beagle installer rather than the legitimate Claude desktop app (Anthropic distributes Claude through claude.ai and the Mac App Store, not standalone Windows installers). Beagle harvests credentials from browsers, cryptocurrency wallets, Discord tokens, and SSH keys. Distribution is via Google Ads on Claude-related search terms - the same paid-placement abuse pattern hitting GoDaddy ManageWP, AWS, and Notion.

Check

Search proxy logs for visits to Claude-themed domains other than claude.ai or anthropic.com over the past 30 days. Hunt Windows endpoints for processes with Anthropic-branded names not signed by Anthropic.

Affected

Windows users searching for Claude or Anthropic products via Google search, particularly developers and AI-curious users. Acute risk: organizations whose staff use Claude through individual rather than enterprise accounts (no centralized management), and developers who pull AI tooling installers from search results. Cryptocurrency holders are at the highest risk.

Fix

Block Google Ads on AI-product searches via corporate browser policy or uBlock Origin. Brief staff that Anthropic distributes Claude through claude.ai and the Mac App Store - there is no standalone Windows installer. Treat any endpoint that downloaded a 'Claude installer' since April as compromised: rotate browser-stored credentials, crypto wallet keys, Discord tokens, and SSH keys.