Researchers have identified a new InstallFix malware campaign targeting developers through fake Claude Code installation guides. This social engineering attack tricks users into manually executing malicious commands that deploy infostealers like Amatera (Windows) and MacSync(macOS). 

Attack Vector and Social Engineering

The campaign leverages “perfect clones” of official documentation to gain user trust: 

• Malvertising: Attackers use Google Ads to place fraudulent sites at the top of search results for queries like “install Claude Code” or “Claude Code CLI”.
• Cloned Documentation: The malicious sites—often hosted on legitimate platforms like Squarespace or Cloudflare Pages—mimic the layout, branding, and sidebar of real Anthropic documentation.
• The “Fix” Lure: Unlike traditional ClickFix attacks that fake browser errors, InstallFix focuses on providing “official” installation instructions that users expect to copy and paste into a terminal. 

Technical Execution

The malicious commands vary by platform but prioritize stealth and fileless execution:

• Windows: Commands launch mshta.exe (a signed Microsoft binary) to fetch and execute a remote HTA payload directly in memory. This triggers the installation of the Amatera infostealer, which targets browser passwords, cookies, and session tokens.
• macOS: Victims are instructed to run a curlcommand that decodes a Base64 string and pipes it directly into the Zsh shell. This installs MacSync, an infostealer capable of harvesting Keychain passwords and crypto wallets.
• Persistence: The attack is designed to be “one-shot” for quick data exfiltration, though some variants may attempt to establish long-term access to developer workstations. 

Protective Measures

To avoid these attacks, developers should:

• Verify URLs: Only use the official Anthropic documentation (e.g., code.claude.com) for installation instructions.
• Avoid Promoted Results: Skip “Sponsored” search results for software tools, as these are frequently abused for malvertising.
• Inspect Commands: Before pasting, decode any Base64 strings in curl or powershellcommands to ensure the destination URL is legitimate.