Fake Claude Code install guides push infostealers in InstallFix attacks

Researchers observed an active InstallFix campaign where attackers publish cloned installation pages for popular CLI tools (e.g., Claude Code) through malvertising and search-sponsored results; these pages contain malicious install commands that fetch and execute the Amatera information stealer, enabling theft of browser credentials, cookies, and cryptocurrency wallets while the pages otherwise mirror legitimate documentation.