Fake Anthropic Site Distributes PlugX Trojan to AI Users

SAN FRANCISCO — A malicious website impersonating Anthropic's Claude artificial intelligence platform distributed a PlugX remote access trojan to unsuspecting users on April 13, 2026. The operation exploited the growing popularity of AI tools to trick visitors into downloading a compromised installer, granting attackers remote control over infected systems.

The fraudulent site closely mimicked the official Anthropic domain, designed to deceive users seeking access to the popular language model. Security researchers identified the campaign after detecting the distribution of the PlugX malware, a sophisticated tool known for its ability to maintain persistent access to compromised machines. The trojanized installer appeared legitimate, prompting users to execute the file under the assumption they were installing the AI software.

The attack occurred on April 13, 2026, at approximately 09:52 UTC. The specific location of the threat actors remains unknown, though the infrastructure used to host the fake site was traced to servers outside the United States. The PlugX trojan, once installed, allows attackers to execute commands, steal data, and move laterally within a network. It has been associated with state-sponsored espionage campaigns in the past, raising concerns about the potential scope of this operation.

Anthropic, the company behind the Claude AI model, has not publicly commented on the incident. The company's official website remains operational, and no evidence suggests the legitimate platform was compromised. The fake site was taken down shortly after detection, but the extent of the malware distribution remains unclear. Security firms are urging users to verify the authenticity of any AI-related downloads and to scan systems for signs of infection.

The incident highlights the increasing use of AI-related branding in cyberattacks. As demand for artificial intelligence tools grows, threat actors are leveraging this interest to spread malware. The PlugX trojan is particularly dangerous due to its modular design, which allows attackers to customize its capabilities for specific targets. Experts warn that similar campaigns may emerge as other popular AI services become targets for impersonation.

Questions remain about the number of users affected and whether any sensitive data was exfiltrated. The attackers' motives are also unclear, though the use of PlugX suggests a focus on long-term access rather than immediate financial gain. Security agencies are monitoring the situation for further developments, including potential links to known threat groups. Users who downloaded the installer are advised to run full system scans and change passwords for any accounts accessed on the affected machines.

The incident serves as a reminder of the risks associated with downloading software from unofficial sources. As AI tools become more integrated into daily workflows, the potential for social engineering attacks increases. Organizations are advised to implement stricter download policies and to educate employees about the dangers of fake websites. The cybersecurity community continues to track the PlugX variant used in this campaign to prevent future infections.