Fake installation pages Claude Code spreads infostealer
Attackers use pixel-perfect clones of developer tool installation pages distributed via Google Ads to trick users into running malware commands that install Amatera Stealer.
New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT
ClickFix social engineering campaigns deliver Amatera Stealer and NetSupport RAT, using PureCrypter-packed DLLs, MSBuild injection, and WoW64 SysCalls-based evasion to steal sensitive data.