<p>Security researchers at Push Security have uncovered a campaign called “InstallFix” that clones Anthropic’s Claude Code installation pages and serves them through Google-sponsored search ads. The fake pages look nearly identical to the real thing, but swap out the legitimate one-liner install command for a malicious script that deploys the Amatera infostealer.</p>
<h2>How the attack works</h2>
<p>The technique exploits something developers do constantly: copy a one-line install command from a website and paste it into a terminal. The attackers are betting you won’t look too closely at the domain before hitting enter.</p>
<p>The malicious pages are hosted on legitimate infrastructure - Cloudflare Pages and Squarespace - which helps them look trustworthy and slip past email security filters. Since the campaign runs through paid search ads rather than phishing emails, traditional email-based defenses don’t catch it.</p>
<p>The attack plays out differently depending on your OS:</p>
<ul>
<li><strong>macOS:</strong> The pasted command runs a base64-obfuscated script that downloads and executes a second-stage binary.</li>
<li><strong>Windows:</strong> <code>cmd.exe</code> spawns <code>mshta.exe</code>, a legitimate Microsoft binary, to run the malware - a classic living-off-the-land technique that avoids triggering obvious alerts.</li>
</ul>
<p>Once running, Amatera harvests browser passwords, cookies, session tokens, and crypto wallet data.</p>
<h2>Who’s at risk</h2>
<p>Both experienced developers and less technical “vibe-coders” are targeted. Experienced developers are at risk because copy-pasting install commands is second nature. Less technical users are at risk because they may not know what a suspicious command looks like in the first place.</p>
<h2>What to do</h2>
<ul>
<li>Slow down before running any terminal command copied from the web.</li>
<li>Verify the domain matches the official documentation before copying anything.</li>
<li>Don’t copy-paste install commands from sites you landed on through a search ad.</li>
<li>Use real-time anti-malware tools that can catch infostealer behavior at runtime.</li>
</ul>


Collections

Security researchers at Push Security discovered a campaign called 'InstallFix' that clones Anthropic's Claude Code installation pages and serves them via Google-sponsored search ads. The fake pages replace legitimate install commands with a malicious script deploying the Amatera infostealer. On macOS, a base64-obfuscated script downloads a second-stage binary; on Windows, mshta.exe is abused via a living-off-the-land technique. The malware harvests browser passwords, cookies, session tokens, and crypto wallet data. Both experienced developers and less technical users are targeted. Mitigations include verifying domains before copying terminal commands and avoiding install commands from search ad results.

Fake Claude Code install pages are spreading infostealer malware via Google ads