Fake Claude Code Spreads Malware to Windows, macOS Users - TechRepublic

"Attackers are distributing almost identical cloned sites of popular developer tools like Claude Code with fake install instructions via malicious search engine ads - tricking victims into installing infostealer malware instead. The cloned sites closely replicate the official documentation pages for popular tools, but the installation instructions are altered to fetch malware instead of the intended software."

"Many modern utilities rely on one-line installation commands - often using a 'curl to bash' approach - that automatically download and execute scripts from a remote server. While this method makes installation fast and convenient, it also places significant trust in the source hosting the script. If the command points to a malicious server, the user may unknowingly execute harmful code directly on their system."

"As AI coding tools expand beyond experienced developers to a broader audience of less technical users, more people may follow installation instructions without carefully verifying the source, increasing vulnerability to these cloned website attacks and malware distribution campaigns."

Security researchers discovered a malware campaign targeting Claude Code users through cloned websites and malicious search advertisements. Attackers replicate legitimate installation pages for popular developer tools and modify the installation commands to distribute infostealer malware on Windows and macOS systems. The campaign exploits the common practice of using one-line terminal commands with curl-to-bash approaches that automatically download and execute scripts. By pointing users to malicious servers instead of legitimate sources, attackers trick victims into unknowingly executing harmful code. This risk grows as AI-powered developer tools expand to less technical users who may not verify installation instructions carefully.

Read at TechRepublic