JadeProx: when threat actors pretend to be Claude
Group-IB published research this week exposing JadeProx, a China-nexus espionage cluster that has been operating since early 2026 against governments, hospitals, and universities across Asia and Latin America. The technical findings are significant, but one detail stands out: one of the group's delivery mechanisms was a fake Anthropic Claude software installer. The lure domain was registered March 28, 2026, and served a malicious MSI that planted a persistent loader in the Windows Startup folder.
AI software impersonation as a malware delivery mechanism is not new. What this case illustrates is how fast the tactic has matured. Claude was not a household enterprise name eighteen months ago. It is now, and attackers are exploiting that recognition.
How Group-IB found the campaign
The investigation started from an operator mistake. A server in Alibaba Cloud's Singapore region, used for command-and-control infrastructure, was left with directory listing enabled. Group-IB found it in mid-April 2026. The exposed directory contained bash history, webshell paths, phishing kits, and a full post-exploitation toolkit. By the time the report published on July 23, the server was offline.
An OPSEC error of that kind is unusual for what appears to be a state-affiliated operation. The exposed material provided a complete picture of the group's tooling and targeting, which is why this campaign is documented in detail when others remain partially obscured.
The TriBack Loader
The malware family used in the campaign is called TriBack Loader, a previously undocumented Windows loader engineered to evade modern endpoint detection and response products. It abuses signed binaries and uncommon Win32 callback APIs, a technique that bypasses EDR sensors that rely on standard API call interception. The loader places its sideloading chain in the Windows Startup folder for persistence.
Confirmed targets from the exposed server data include a Vietnamese public hospital's medical imaging system, Malaysia's Ministry of Foreign Affairs, Hong Kong education infrastructure, and spear-phishing materials addressed to the National Congress of Honduras and a Venezuelan municipal tax system.
The Anthropic lure and what it means for enterprise security
The fake Claude installer domain was registered on March 28, 2026, less than two months after Anthropic released Claude for enterprise use at scale. The attackers did not need much time to weaponize the brand. Any software that goes from niche to enterprise-standard quickly becomes a delivery mechanism target, because user trust in the brand outruns their familiarity with what a legitimate installation actually looks like.
Standard phishing awareness training teaches employees not to click suspicious links. That guidance does not address an employee who navigates to what looks like an official AI software download page and installs what they believe is a legitimate enterprise tool. The failure mode is a policy gap, not a user error.
What defenders should do
Enforce application allowlisting for AI tool installation. Approved AI software should come through managed distribution channels, not direct downloads from vendor websites that employees find themselves. Audit Windows Startup folder entries on endpoints regularly, as this is where TriBack establishes persistence. Review EDR policy for signed-binary abuse detection, specifically callback API patterns not associated with expected software. If Group-IB's IOC set is available through your threat intelligence feed, ingest it now.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are investigating a potential JadeProx or TriBack Loader incident, or want to discuss AI brand lure defense strategies.