Fake Claude AI Installer Pages Trick Users Into Malware Downloads

A sophisticated social-engineering campaign (InstallFix / Fake Claude Installer) uses deceptive Google Ads and pixel-perfect fake installation pages to trick developers into running malicious commands that download a polyglot msixbundle containing an appended HTML Application payload. The chain uses mshta.exe to load a COM Shell Launcher that runs obfuscated VBScript and a heavily disguised PowerShell stager which disables SSL validation, establishes persistence via scheduled tasks, harvests browser and e-wallet data, and contacts attacker-controlled infrastructure across multiple regions and industries.