Fake Claude Code Installers Deliver Credential-Stealing Malware
ID: 1304e6a3-9178-5642-9ae2-f27c209a8f0c
STIX ID: report--1304e6a3-9178-5642-9ae2-f27c209a8f0c
Feed Name: TechRepublic Security
Threat Score
Researchers uncovered a large-scale credential-theft campaign that impersonates AI developer installation docs (notably Claude Code) to trick developers into running malicious install commands; the operation uses SEO poisoning, paid ads, and rotating infrastructure across 88+ domains and delivers ACRStealer and clipboard hijackers via multiple techniques to exfiltrate API keys, authentication tokens, cloud credentials, and cryptocurrency information.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.