Fake Claude Code install pages highlight rise of “InstallFix” attacks

Push Security and reporting warn of a malvertising campaign that faithfully clones Anthropic’s Claude Code install page and uses paid Google Search ads to show malicious installation instructions; Windows victims are delivered the Amatera stealer and macOS users may receive similar info‑stealers. Researchers label the social-engineering tactic “InstallFix,” noting attackers exploit users’ habit of pasting install one-liners and hijack ad budgets to scale the attack.