The **InstallFix campaign** is a sophisticated attack that weaponizes malvertised installation guides to distribute infostealer malware.
- **What Happened**: Attackers are creating **imitation installation pages** for popular developer tools, such as Anthropic's Claude Code. These fake pages are then promoted through malicious Google Ads. When users search for and attempt to install these tools, they are directed to these deceptive sites. The pages present users with seemingly legitimate installation commands. However, when these commands are executed, they instead download and run **Amatera Stealer**, an infostealer malware.
- **Who is Affected**: The campaign primarily targets **developers** who are actively seeking to install new tools. It also affects a growing number of **non-technical users** who are adopting these developer tools. The vulnerability stems from the common practice of users trusting commands presented on websites, especially when found through search engine results.
- **Security Implications**: This attack bypasses traditional security measures like email filters because it operates through **malvertising** and **social engineering**. Attackers exploit the trust users place in search engines and the ease with which commands can be copied and pasted. The stolen data can include sensitive information such as passwords, cookies, and system details, leading to potential account takeovers and further compromise.
- **Technical Details**:
- Attackers use **lookalike domains** that closely resemble legitimate ones.
- These fake sites are often hosted on legitimate services like **Cloudflare Pages or Squarespace** to appear more trustworthy.
- The malware payload is executed using Windows commands like `cmd.exe` and `mshta.exe`, or similar methods on macOS.
- The malware is retrieved from **attacker-controlled servers**.
- Amatera Stealer employs techniques to **evade antivirus detection**.
- **What Defenders Should Know**:
- This is part of a **broader trend** affecting various popular software tools, not just specific ones like Claude Code.
- Traditional **Indicator of Compromise (IoC)-based detection** is less effective because attackers rapidly rotate malicious domains.
- Detection strategies should focus on **browser-level analysis**, looking for indicators such as lookalike domains, the presence of copy-to-clipboard commands, and malvertising signals.
- The attack vector is **stealthy**, as it's initiated by users actively searching for software they intend to install, making interception difficult before execution 【1】.