Scammers are buying search ads for fake Claude Code and ChatGPT install pages that look like the vendor's docs but tell you to paste a malicious command into your terminal. Anyone installing an AI coding tool by searching for it is exposed. The fix is simple: take install commands only from the vendor's own documentation, never from an ad or a search result you did not verify.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Only if you ran an install command from a page reached through a search ad or lookalike domain. |
| Is there a fix? | There is no software patch; this is social engineering. Reinstall from the official docs and rotate secrets if you ran a suspect command. |
| Does data leave my machine? | The malware families in these campaigns are infostealers, so credentials, keychain data and wallets can. |
| Can Beam help? | Partly. It can scan agent config files and flag risky agent actions, but it does not see commands you type yourself. |
What the researchers found
Graphika reported a spike in fraudulent ads in April 2026 for keywords such as "get claude code" and "claude design". The ads used verified Google Ads accounts, which Graphika says "build an appearance of credibility", and sent victims to pages "hard to distinguish from the real company's pages". An earlier campaign in late 2025 used about 400 ads for a fake ChatGPT Atlas browser.
The Cloud Security Alliance research note groups the activity into three patterns: typosquatted packages in registries, cloned "InstallFix" pages distributed through search ads, and malicious lures hosted on legitimate AI platforms.
Timeline: from ClickFix to InstallFix
The technique did not appear overnight. Push Security, which named it, described InstallFix on March 6, 2026 as part of the wider ClickFix family. Classic ClickFix attacks have to invent a reason for you to paste a command: a fake CAPTCHA, a made-up error message, a bogus system prompt. InstallFix needs none of that. In Push's words, "the pretext is simply the user wanting to install legit software."
The dates line up as follows, all from the cited reports:
- Late 2025. Graphika saw a verified Google advertiser run about 400 ads for a fake "ChatGPT Atlas" browser, with a landing page that told users to run a curl-to-bash command. The ads were posted by an Estonian company, CoinSun OÜ, which Graphika says had been registered since 2019 but showed no significant revenue or employees.
- March 6, 2026. Push publishes the InstallFix write-up on cloned Claude Code install pages. On March 16 it added more pages, this time cloning the Claude Code docs page as well as the quickstart, and a clone of Google's NotebookLM.
- March 10, 2026. The Cloud Security Alliance AI Safety Initiative publishes its research note, placing the campaign next to typosquatted packages and platform abuse.
- April 2026. Graphika sees a spike in fraudulent ads for keywords such as "get claude code" and "claude design". It published its findings on May 1, 2026.
Reading the sources together, this is a pattern that kept moving to whichever AI tool was popular that month, not a single campaign against one vendor.
How the lure works, step by step
- You search for how to install Claude Code and click a sponsored result.
- The page mirrors Anthropic's documentation but replaces the install command. Graphika describes
curl-to-bashterminal commands, and a PowerShell command on a page aimed at Windows users. - You paste it. On Windows the CSA note describes a chain from
cmd.exetomshta.exeto remote HTML. - An infostealer runs. The CSA note names Amatera Stealer in the InstallFix campaign and MacSync, which targets the macOS Keychain, browser credentials and wallets.
The note also reports that attackers published terminal-command lures as Claude artifacts on claude.ai, so the domain itself looked trustworthy. It says more than 10,000 users accessed those artifacts before removal. Graphika lists indicators including claude-code-macos[.]com and a GitLab-hosted page mimicking Anthropic branding.
The sources do not agree on every number. Push, writing in March, says the fake Claude artifacts were viewed over 15,000 times before takedown; the CSA note says more than 10,000 users accessed them. Both describe the same kind of activity, but treat the exact figure as unsettled.
Why the clone is hard to spot
Push describes a clone that reproduces "layout, branding, documentation sidebar, and all". The only meaningful difference is inside the command itself. Instead of fetching the install script from claude.ai, the command points at a server the attacker controls. Unless you read the URL embedded in the one-liner, the page is indistinguishable from the real one.
Three details make this more effective than a plain phishing page:
- The ad carries the trust. Push reports that the pages were distributed through sponsored results for searches such as "Claude Code", "Claude Code install" and "Claude Code CLI". A sponsored result sits above the organic link to the real documentation, and search engines typically suppress subdomains in the displayed URL, which gives a lookalike host extra cover.
- Interaction sends you away. On some detected pages, any further click redirects to the legitimate site. A victim who pasted the command and then followed a link would land on genuine documentation and have no reason to suspect anything.
- The infrastructure is borrowed. Push observed Cloudflare Pages, Squarespace and Tencent EdgeOne; Graphika notes the use of GitLab. Hosting on trusted platforms helps the pages blend into normal web traffic, and Graphika adds that many tracked domains were registered only days before their ads ran, such as
last-version.install-2026.com, which defeats filters that rely on domain reputation.
The CSA note adds a structural point: email security gateways do not inspect search ad traffic. It cites Push's finding that four out of five InstallFix and ClickFix lure accesses come from search engines rather than email links. A defence built around the inbox does not see this attack at all.
What the payload does
On Windows, Push traced the chain from cmd.exe to mshta.exe, which fetched remote content from a lookalike update domain. The payload matched Yara signatures for Amatera Stealer. Push describes Amatera as a subscription-sold infostealer that started appearing publicly around 2025, considered an evolution of ACR Stealer, which targets saved passwords, cookies, session tokens and system information. The CSA note adds that it uses WoW64 syscalls and direct NTSockets for command-and-control, which helps it avoid tools that watch standard Windows API calls.
On macOS, Push says the payload uses additional encoding and staged execution layers. The CSA note describes the MacSync stealer in the separate claude.ai artifacts campaign: it takes Keychain data, browser credentials and wallet contents, and posts them to an attacker endpoint in chunked archives with eight retry attempts. That retry design is aimed at flaky connections, so a brief network drop does not save you.
For a developer, the value of the target is the point. The CSA note observes that a developer workstation typically holds cloud provider keys, repository tokens, secrets in environment files and CI configuration, and browser sessions for SaaS tools. A coding agent machine often holds all of these at once.
What the official install looks like
It helps to know what the real thing looks like, because the lure copies it. Anthropic's setup page lists the native install as curl -fsSL https://claude.ai/install.sh | bash on macOS and Linux, irm https://claude.ai/install.ps1 | iex in PowerShell, and a CMD variant. It also documents brew install --cask claude-code, winget install Anthropic.ClaudeCode, and apt, dnf and apk packages for Debian, Fedora, RHEL and Alpine.
Two checks follow from that page:
- The host in the command is
claude.ai. A command that fetches from any other host is not the documented installer, whatever the page around it looks like. - After installing,
claude --versionshould print a version number, andclaude doctorprints read-only installation and settings diagnostics without starting a session. A working version check does not prove the machine is clean, though. A malicious script could install the real binary as well as the payload, so use these to check your install, not to rule out compromise.
The curl-to-bash pattern itself is the weakness Push points at: Homebrew, Rust, nvm and Bun all ship similar one-liners, and "the entire security model boils down to 'trust the domain.'" Package-manager installs (Homebrew, WinGet, apt) move that trust to a repository you have already configured, which is one reason to prefer them when you can.
What this means if you run AI coding agents
- Check your source. Reinstall only from Anthropic's documentation, reached by typing the address, not through an ad. Treat search results as unverified, as Graphika advises.
- Read before you pipe. A one-line
curl ... | bashruns whatever the server returns. Download the script and read it first. - If you ran a suspect command, assume exposure. From a clean device, rotate API keys, cloud tokens, SSH keys and browser-saved passwords.
- Audit agent configs. The CSA note recommends reviewing MCP server configurations in every AI coding tool and treating unrecognized entries as possible compromise indicators. Its SANDWORM_MODE example is an npm worm that injected rogue MCP entries into Claude Code, Cursor and other tools' configs; see our coverage of npm worms targeting AI tooling.
- Verify package names. The note cites research that about 20% of generated code samples referenced nonexistent packages, and that attackers can register those names. It adds that 58% of hallucinated names recurred across ten runs of the same prompt, which is what makes registering them worthwhile for an attacker.
- Check where the command will fetch from. Before pasting any one-liner, read the host. If it is not the vendor's own domain, stop.
- Prefer package managers. Where the vendor documents Homebrew, WinGet or a Linux package repository, those installs avoid the pipe-to-shell step.
- Bookmark the docs. Typing or bookmarking the vendor address removes the ad from the path entirely.
- If you manage a team, the CSA note recommends endpoint detection that can spot terminal-spawned processes writing to credential stores or contacting unusual external addresses, plus network controls that inspect outbound traffic, since email filtering does not cover search ads.
If you already ran a suspect command
Work through this in order, from a clean device:
- Rotate cloud provider keys, repository tokens, API keys for AI providers, and SSH keys.
- Sign out of browser sessions and change saved passwords, since the stealers described here take cookies and session tokens as well.
- Move any cryptocurrency wallet funds, because the CSA note says MacSync takes wallet contents.
- Review MCP and agent config files for entries you did not add.
Related incidents in the same family
The CSA note places InstallFix inside a longer record of AI-brand impersonation, which is useful context for anyone deciding how much weight to give a single campaign:
- JarkaStealer via PyPI. Two packages,
gptplusandclaudeai-eng, were uploaded in November 2023 and found by Kaspersky in November 2024 with about 3,574 combined downloads. A year passed between upload and discovery. - DeepSeek typosquats.
deepseeekanddeepseekaiwere uploaded twenty minutes apart on January 29, 2025 and harvested environment variables before removal, after 222 downloads. - Slopsquatting. A researcher at Lasso Security registered
huggingface-cli, a name models hallucinated, as a harmless demonstration. The CSA note says it reached more than 30,000 downloads in three months. - SANDWORM_MODE. In February 2026, Socket researchers found 19 malicious npm packages that injected a rogue MCP server entry into the config files of several AI coding tools. Beam covered the follow-on risk in npm supply-chain worms targeting AI tooling.
For a broader view of the pattern, see Beam's AI agent security incidents timeline.
What Beam can and cannot do here
Beam cannot stop you from pasting a command into your own shell, and it is not a kernel sandbox. What it can do, per its docs, is run offline heuristic checks with beam scan .mcp.json --mcp, which validates MCP JSON and examines version pinning, so you can inspect a config you are unsure about. For actions taken by Claude Code or Codex, hook-based deny can block risky commands before they run, as covered in stopping dangerous Claude Code commands. Scanning is heuristic, not semantic malware analysis. Everything stays on your device; see how Beam stays local.
For more context, read our MCP security guide and agent supply-chain security overview.
Frequently asked questions
What is InstallFix?
InstallFix is a lure where a cloned install page looks like a vendor's documentation but swaps the legitimate install command for a malicious one. The Cloud Security Alliance describes it for Claude Code, alongside the related ClickFix technique.
How do I know my Claude Code install is genuine?
Check where you got the command. Only copy install steps from Anthropic's own documentation, typed into the address bar rather than reached through a search ad, and run claude --version to confirm the binary responds as expected.
What should I do if I ran a command from a lookalike page?
Treat the machine as compromised. Rotate API keys, tokens, SSH keys and browser-stored credentials from a clean device, and review your MCP and agent config files for entries you did not add.
Can Beam block a malicious install command?
Not one you type yourself in a terminal. Beam watches what supported agents do and can deny risky actions through Claude Code and Codex hooks, but it is not a kernel sandbox and does not inspect commands you run outside an agent.
Are AI-suggested package names a related risk?
Yes. The CSA note describes slopsquatting, where attackers register package names that language models hallucinate, so verify every suggested name against the registry before installing.
Is the official Claude Code installer also a curl-to-bash command?
Yes, for the native install. Anthropic's setup page lists curl -fsSL https://claude.ai/install.sh | bash, and also documents Homebrew, WinGet and Linux package managers. The danger is the domain inside the command, not the pattern itself, so read the host before you press Enter.
Details reflect the cited reports as of October 16, 2026. Campaign domains rotate quickly, so check the sources for current indicators.