The Vibe-Coding Trap: Fake Claude Code Installers Unleash Amatera Malware via Search Ads
ID: e81cad6a-d142-5795-a760-475a5846feb5
STIX ID: report--e81cad6a-d142-5795-a760-475a5846feb5
Feed Name: securityonline.info
Threat Score
Push researchers uncovered an active "InstallFix" malvertising campaign that places near-identical fake Claude Code installation pages in sponsored search results; the fake install command points to attacker-controlled servers hosting Amatera, a commercial information stealer. The campaign leverages trusted hosting providers to blend in and uses advanced evasion (direct NTSockets, dynamic API resolution, WoW64 syscalls, and CDN IP masking) to hinder detection and blocking.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.