Dubbed InstallFix by Push Security, the scheme inserts instructions to download malware during the Claude Code install process on cloned websites.

Threat actors are exploiting a common developer habit — copying installation commands directly from websites — to distribute malware through fake software installation pages. Security researchers at ...

Attackers are using fake Claude Code install pages and malicious search ads to spread infostealer malware targeting Windows ...