Threat Actors Using Fake Claude Code Download to Deploy Infostealer

**Executive summary:** Cybercriminals are distributing an MSHTA-based infostealer by hosting convincing fake Claude Code download pages that invoke mshta.exe to fetch and run remote HTA scripts in memory; the malware harvests browser-stored credentials, session tokens, and other sensitive data, putting developers' code repositories and cloud credentials at risk, and defenders are advised to log and restrict mshta.exe activity and verify downloads from official sources.