Fake Claude Code Install Pages Deliver Multi-Stage Malware

May 5, 2026 · Original article ↗

Summary

Trend Micro details InstallFix, a campaign using Google Ads and fake Claude Code installation pages to trick users into running commands that launch multi-stage malware with evasion, persistence, and data-collection capabilities.

Key points

Fake Claude Code installation pages promoted through Google Ads use OS-specific instructions to persuade users to run malicious commands.
On Windows, the command launches PowerShell and mshta.exe to execute a ZIP/HTA polyglot posing as a Claude installer.
The infection chain uses obfuscated VBScript and PowerShell, an AMSI bypass, disabled SSL certificate validation, and in-memory payload execution.
The malware fingerprints infected machines to generate victim-specific command-and-control URLs and creates scheduled tasks for persistence.
Analysis observed attempts to collect browser and e-wallet application data and connections to external infrastructure; the final payload was not fully recovered.
Trend Micro telemetry recorded its detection rule triggering and endpoint protection terminating part of the process chain.
The article recommends verifying software sources, avoiding commands from unfamiliar sponsored results, and monitoring or restricting mshta.exe and suspicious network activity.

Article Details

Attack Vectors: Fake Claude Code installation pages promoted through Google Ads sponsored search results.
ClickFix-style social engineering instructs users to run OS-specific commands; on Windows, the command launches PowerShell and mshta.exe.
A ZIP/HTA polyglot named claude.msixbundle delivers an embedded, obfuscated VBScript payload.
The VBScript uses Shell.Application to launch an encoded PowerShell stager, which retrieves and executes a further payload in memory.
Defensive Notes: Block the campaign's identified malicious domains and IP addresses at firewalls or security gateways, and use DNS filtering or a secure web gateway for suspicious domains.
Limit or block mshta.exe where it is not required; monitor for mshta.exe spawning shell processes and for suspicious encoded PowerShell or Invoke-Expression activity.
Configure endpoint protection to block or terminate suspicious behavior, and apply relevant threat intelligence and detection rules.
Educate users not to run installation commands from unfamiliar websites or sponsored search results; verify download pages against the official vendor site and prefer trusted package managers.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`download-version[.]1-5-8[.]com`	Malicious payload-delivery domain used to serve claude.msixbundle.
DOMAIN	`oakenfjrod[.]ru`	Article identifies this as an attacker-controlled domain used for victim-specific payload retrieval.
HOSTNAME	`hosted-by[.]yeezyhost[.]net`	Hostname reported as resolving to the IP address contacted during unsuccessful malware C&C connection attempts.
IPV4	`77[.]91[.]97[.]244`	Destination of unsuccessful TCP connection attempts associated with the malware's C&C activity.
SHA1	`811fbf0ff6b6acabe4b545e493ec0dd0178a0302`	Hash of the file recovered from the final-stage payload path; execution was not confirmed.
SHA256	`2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74`	Hash of the final-stage payload, which the article says was not fully recovered.