'InstallFix' Attacks Spread Fake Claude Code Sites

Push Security disclosed an "InstallFix" campaign that uses Google-sponsored ads and near-identical cloned Claude Code install pages to trick users into pasting malicious terminal commands that install Amatera Stealer, an infostealer capable of exfiltrating developer credentials and compromising enterprise development environments; attackers also leverage legitimate hosting providers for deceptive domains and IoCs are short-lived.