Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.

Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users into running malicious commands under the pretext of installing legitimate command line interface (CLI) tools.

Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users into running malicious commands under the pretext of installing legitimate ...

Fake Claude Code install guides push infostealers in InstallFix attacks

Business

Dubbed InstallFix by Push Security, the scheme is a modification of the ClickFix social engineering scam. It inserts instructions to download malware during the Claude Code install process on cloned websites. The attack bypasses many standard malware protections because the user initiates it. Where that often requires the user to open a run dialogue box or perform a CAPTCHA check, InstallFix adds a dodgy URL to an install guide you already trust, making it easy to slip up.

Threat actors are employing a new variation of the ClickFix social engineering technique called InstallFix to convince users into running malicious commands under the pretext of installing legitimate…

Groups Conversations All groups and messages Sign in     InstallFix: How attackers are weaponizing malvertized install guides 0 views Eyal Estrin unread, 7:35 AM (21 minutes ago)    to https://pushsecurity.com/blog/installfix/ Eyal Estrin Author | Cloud Architect | AWS • Azure • GCP Insights Social: @eyalestrin Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com Reply all Reply to author Forward

The cyberattacks blend malvertising with a ClickFix-style technique that highlights risky behavior with AI coding assistants and command-line interfaces.

A fresh cyberattack campaign blends malvertising with a ClickFix-style technique that highlights risky behavior with AI coding assistants and command-line interfaces.

The cyberattacks blend malvertising with a ClickFix-style technique that highlights risky behavior with AI coding assistants and command-line interfaces.

The cyberattacks blend malvertising with a ClickFix-style technique that highlights risky behavior with AI coding assistants and command-line interfaces.

Des hackers ont utilisé le SEO parasite et Google Ads pour diffuser le malware Amatera Stealer via de faux plugins Claude. Découvrez l'attaque InstallFix et co…

Joshua Rudd has been appointed as the new head of both Cyber Command and the NSA. Investigations are underway regarding mishandling of Social Security data by a former official. Microsoft, Adobe, Fortinet, Ivanti, and Intel released patches to address numerous vulnerabilities during Patch Tuesday. Intelligence groups anticipate increased cyber activity stemming from potential conflicts with Iran. A new Android malware called BeatBanker is spreading through a fake Starlink app. InstallFix attacks are targeting developers with infostealers disguised in fake install guides. Malware called ZombieZIP is using archives to bypass security tools. DHS removed CBP officials who questioned directives involving FOIA requests and secrecy. Ben Yelin discussed Anthropic's lawsuit against the Pentagon concerning AI contracts. AI-powered eyewear has raised privacy concerns due to accidental exposure of sensitive content.