A threat actor is running an active campaign that impersonates Anthropic’s Claude AI, CrowdStrike, SentinelOne, and Trellix to trick Windows users into installing a new backdoor called Beagle. The malware uses a legitimate G Data security binary to load malicious code, evading many traditional defenses, and connects to attacker-controlled infrastructure on Alibaba Cloud for remote access. Organizations whose employees download security or AI tools from unverified sources are directly exposed; a successful infection gives attackers persistent, remote control of the affected system.