AI Hype Hijacked: How a Fake Claude Installer Blinds Windows Security

Rapid7 analysis describes a sophisticated ClickFix campaign using a fake Claude MSIX bundle that is actually a ZIP containing an HTA with obfuscated VBScript. The VBScript decodes and runs a PowerShell staging payload that tailors callbacks using an MD5 of the host identifiers, disables AMSI by corrupting amsiContext, and injects encrypted shellcode into memory via native NT APIs; detection occurred when mshta.exe was observed executing suspicious arguments.