InstallFix Campaign Clones Claude Code to Spread Malware Without Exploits

On May 6, 2026, a malvertising campaign impersonating Claude Code—an unofficial command-line tool linked to the Anthropic ecosystem—came to light. Attackers purchased Google Ads space, redirected users to cloned documentation pages hosted on Squarespace, and tricked them into copying malicious installation commands: a chain abusing mshta.exe on Windows, and an obfuscated base64 script on macOS. The infection requires no software flaw, only the social engineering of the ClickFix technique—or InstallFix, in PushSecurity’s naming.

How the InstallFix Mechanism Works

PushSecurity coined the term InstallFix to describe this evolution of the ClickFix technique: instead of a generic page with a fake CAPTCHA, attackers pixel-perfectly clone the installation pages of legitimate CLI tools. The only meaningful difference lies in the URL within the one-liner command. According to PushSecurity, "the page is a near-pixel-perfect replica of the real thing. The only meaningful difference is in the installation commands themselves."

The choice of Claude Code is no accident. The editorial briefing documents that 4 in 5 users who interact with ClickFix lures arrive from search engines. A user searching "install Claude Code" finds the sponsored ad, clicks, sees plausible documentation, and copies the proposed command. After execution, any further interaction on the page redirects to the legitimate site, lowering suspicion.

Bitdefender Labs describes the same dynamic with technical precision: "What makes this dangerous is that the attackers never exploit a software flaw. The entire infection relies on the victim's willingness to follow instructions and fall for the ClickFix social engineering tactic." The campaign demonstrates that the attack surface has shifted from software to the operator.

The Windows Attack Chain: mshta.exe and MSIL Stager

On Windows, users received a PowerShell command that abuses mshta.exe, a legitimate Microsoft utility for executing HTML Applications. The remote HTA file launches an MSIL stager that loads the final shellcode. The entire chain is memory-resident: no payload is written permanently to disk in the initial stages, reducing visibility for EDR.

Detection signatures documented by Bitdefender identify multiple payloads in the same campaign: Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316, Gen:Variant.Barys.509034. The variety of detections suggests modular components or multiple stealer families distributed in parallel, but the dossier does not clarify whether this is a single polymorphic toolkit or distinct payloads.

The documented SHA256 hashes for the campaign’s Windows/macOS samples per Bitdefender are: 79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19, 3b4d3a59024f14cf1f07395afd6957be05d125e00ae8fdcea3a5dee1d8ab9dd3, eb4d9a0e4c483dc29ae8c4d31fafcd583c457923d3344745b5c7ab13abed4dc5, 505b32ac2b6fffb5fac81d5bdc2e1e8581fc4196dfb01aee852216a3ad6ff47e, 762fb099115d1917b6f673cc5c74a4b61962a64d640673aaf02566ca6a3dbfa4, a78e487995ab452c5990b4baff6a4fa485ae2798c2ddd13718c17eb641f11646.

The macOS Side: Mach-O Backdoor with Anti-Analysis

The macOS variant follows a different but equally linear path. The command copied by the user is an echo with a base64 payload that, decoded with base64 -D and piped to zsh, downloads a loader script. This drops a Mach-O binary in /tmp/helper, strips extended attributes with xattr -c, sets execute permissions, and launches it.

The final binary is a backdoor capable of spawning /bin/bash or /bin/zsh for remote command execution. Bitdefender notes the malware performs anti-sandbox and anti-VM checks "similar to AMOS stealer," but the dossier does not confirm the payload is actually AMOS. PushSecurity, analyzing a related sample, instead identifies a match with Yara signatures for Amatera Stealer, with a command-and-control server at claude[.]update-version[.]com. The relationship between AMOS and Amatera Stealer is not clarified by the sources: they may be the same malware under different names, or related families.

The persistence mechanism leverages the mod_init_func global constructor for automatic execution on load, a technique that requires no launchctl or visible plist jobs.

Infrastructure and Context of Related Campaigns

The clone site was hosted on a Squarespace subdomain, as documented by Bitdefender: "The fake documentation page was hosted on a Squarespace subdomain." The platform choice is not neutral: it allows combining a reputable hosting domain with content independently controlled by the attacker. A parallel campaign documented by SCWorld on Codex, which exploits the same ClickFix TTP, explicitly describes this pattern: "This separation lets the attacker combine a trusted hosting domain with independently controlled ClickFix content."

SCWorld further corroborates that infrastructure used in the Codex campaign was reused for Claude Code-themed campaigns, reinforcing convergence between the two threads. This reuse does not imply a single operational unit, but documents an economy of scale in managing attack assets.

The advertiser account used for the Google Ads is associated with a real Malaysian company. Bitdefender assesses that attackers likely compromised the legitimate account rather than creating it from scratch. Google disabled the account following the report.

"4 in 5 ClickFix lures we intercept are accessed from search engines" — PushSecurity

Why This Matters

The campaign documents a turning point in the relationship between developers and security. The practice of copying curl | bash commands from websites, normalized for years in the open-source ecosystem, has become an attack vector in its own right. Attackers no longer need to convince users to run something anomalous: they only need to serve exactly what the user expects, with a slightly different command that no one verifies.

The adoption of AI tools exposes less technical users to developer-grade installation flows, expanding the attack surface. The InstallFix mechanism requires no exploits, zero-days, or advanced reverse-engineering skills: social engineering, web cloning, and hosting on legitimate platforms are enough to make the attack scalable and low-cost.

The brief does not document specific remedial measures indicated by primary sources. No explicit operational recommendations emerge from Bitdefender or PushSecurity in the analyzed material. The dossier also does not specify the nature of data exfiltrated by the Windows payloads, nor the current status of command-and-control infrastructure.

Outstanding questions remain: the exact campaign start date (PushSecurity cites an update to "March 16" without specifying the year); the actual victim count; whether variants exist beyond those documented; and any definitive correlation between AMOS and Amatera Stealer.

FAQ

Sources

• https://www.techedubyte.com/fake-claude-code-malware-windows-macos/
• https://stage.bitdefender.com/en-gb/blog/labs/fake-claude-code-google-ads-malware
• https://www.scworld.com/news/codex-clickfix-installation-lure-spreads-suspected-amos-infostealer
• https://pushsecurity.com/blog/installfix/
• https://www.bitdefender.com/en-gb/blog/businessinsights/how-clickfix-cyberattack-technique-works?srsltid=AfmBOooOGUTc1_PsvutjVR__O9fBBVixrY6KwkNDuhoQPdqdrhNvDoIJ

Information is based on the cited source and current as of publication.

Sources