Fake Claude Code install guides push infostealers in InstallFix attacks

Attackers are using InstallFix, a social engineering technique, to distribute the Amatera Stealer malware through fake installation pages for Claude Code that closely mimic the legitimate site. These cloned pages contain malicious install commands designed to trick users into running code that downloads the malware, and are promoted via malvertising (fake ads in search results) on Google Ads.