{"data":{"id":"80eadd0d-f680-47ab-8715-762fba36eae5","title":"Fake Claude Code install guides push infostealers in InstallFix attacks","summary":"Attackers are using InstallFix, a social engineering technique, to distribute the Amatera Stealer malware through fake installation pages for Claude Code that closely mimic the legitimate site. These cloned pages contain malicious install commands designed to trick users into running code that downloads the malware, and are promoted via malvertising (fake ads in search results) on Google Ads.","solution":"Users looking for Claude Code must ensure they get installation instructions from official websites, block or skip all promoted Google Search results, and bookmark software download ports.","labels":["security"],"sourceUrl":"https://www.bleepingcomputer.com/news/security/fake-claude-code-install-guides-push-infostealers-in-installfix-attacks/","publishedAt":"2026-03-06T15:00:00.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain"],"issueType":"news","affectedPackages":null,"affectedVendors":["Anthropic"],"affectedVendorsRaw":["Anthropic","Claude Code","Amatera Stealer"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}