Fake Claude Code install pages hit Windows and Mac users with infostealers

Researchers observed a campaign dubbed “InstallFix” where attackers clone official install/docs pages and replace single‑line install commands with malicious scripts that install the Amatera infostealer. The technique targets non‑specialist users by leveraging sponsored search results and authentic-looking pages to harvest browser passwords, cookies, session tokens and other data on both macOS and Windows, enabling session hijacking and access to developer/cloud accounts; guidance includes verifying sources, avoiding copy‑paste commands, and using up‑to‑date anti‑malware protections.