Fake Claude Code Installers on 32 Live Sites Steal Developer API Keys via Google Ads

If you have searched for how to install Claude Code, Cline, JetBrains, or any other popular AI development tool since March 2026, you may have landed on one of the most technically sophisticated supply-chain attacks to target the AI developer community to date. Threat actors built a network of more than 88 fake installation pages, purchased Google Ads to push them above legitimate documentation in results, and used them to deliver credential-stealing malware that never writes a file to your hard drive. As of May 14, 2026, 32 of those fake domains were still live and serving malicious content. Ten new ones emerged while the researchers were writing up their findings.

The campaign has been active since at least early March 2026, when analysts at EclecticIQ first documented it . Security firm Straiker published a detailed technical analysis on May 27, 2026, revealing the full attack chain, the malware's specific targets, and the infrastructure tactics the attackers use to outlast takedowns. The campaign remains active.

The campaign's distribution method is straightforward and hard to stop with awareness training alone. Attackers registered dozens of domains visually similar to legitimate AI tool documentation sites — claudecode[.]co[.]com, claude-setup[.]com, and more than 80 others — across at least ten hosting platforms including Squarespace, GitHub Pages, Cloudflare Pages and Workers, Tencent EdgeOne, and Netlify. They then purchased paid Google Ads to appear above organic results when developers searched for install instructions, with a confirmed campaign ID tied to the fake Squarespace Claude site.

The attack begins the moment a developer copies the install command from one of the fake pages. The command looks legitimate at a glance. Hidden inside it is a single & character.

In a Unix shell, & is a command separator that forks a background job. The legitimate-looking curl request to Anthropic's actual servers fires harmlessly in the background while the malicious payload runs in the foreground. On Windows, the second command invokes the Windows system binary rundll32.exe to load a malicious DLL from an attacker-controlled server over WebDAV, meaning the malware never touches the victim's disk. A fileless infection, delivered by punctuation.

Across the 88-domain network, researchers documented at least four additional delivery variants: base64-encoded URLs piped to zsh, abuse of the Windows mshta.exe binary, GitHub-hosted install scripts that exploit the trusted reputation of the github.com domain, and JavaScript-injected commands that appear only to real browsers — not automated security scanners crawling for malicious content.

The final payload is a sophisticated credential stealer the Straiker researchers call "Amatera" — a variant of the ACRStealer malware family first documented in early 2025. It targets more than 65 browsers, more than 175 cryptocurrency wallet browser extensions, and password managers including KeePass, Bitwarden, and 1Password. It also sweeps messaging apps including Telegram, Discord, and Signal, along with VPN credentials.

What distinguishes this variant from prior ACRStealer builds is a deliberate focus on AI developer credentials. The malware explicitly targets the secrets files used by Cline and Continue.dev — two widely used AI coding assistants — extracting the API keys and authentication tokens stored there. It also targets Snowflake SSH session credentials and browser profiles from Perplexity Comet. These are not incidental targets; they were added to the stealer's configuration specifically.

Stolen AI API keys carry consequences well beyond credential theft. As Check Point Research documented in a February 2026 analysis of separate Claude Code vulnerabilities, a stolen API key can be used to run inference workloads billed to the victim's account, intercept proprietary code sent to AI models for completion, and pivot into connected cloud development environments.

The payload loader is a heavily obfuscated Go binary masquerading as an ASUS system component, bearing a forged Sectigo code-signing certificate issued April 20, 2026 — the same day the campaign's command-and-control infrastructure went live. Before decrypting its 192-kilobyte shellcode payload in memory, it runs more than 20 anti-sandbox checks and five anti-debugger checks, and invokes Windows system calls directly via a technique called Hell's Gate to bypass the hooking mechanisms that most endpoint detection products rely on. The encryption layer uses ML-KEM-768, a post-quantum key encapsulation algorithm designed to resist decryption even by future quantum computers.

Alongside the credential stealer, the campaign deploys a Rust-compiled cryptocurrency clipboard hijacker that polls the clipboard 20 times per second, silently replacing any cryptocurrency address a victim copies with one controlled by the attackers. Replacement addresses are not stored on any server — they are fetched from a Binance Smart Chain smart contract, a method known as EtherHiding that has been used by financially motivated eCrime groups and, separately, adopted by North Korean state- actors according to Google's Threat Intelligence Group. There is no domain to seize and no hosting provider to serve an abuse request to. The attacker updates the wallet addresses by sending a blockchain transaction, and every infected machine picks up the new addresses within minutes.

The campaign's infrastructure is engineered for resilience. Fake sites are distributed across at least ten hosting platforms so that takedowns on any one platform leave the rest of the operation untouched. New domains appeared throughout the Straiker research window, including ten GitHub Pages domains created between May 11 and May 14, 2026, built under fake developer portfolio personas — "Ellis Park," "Iris Volkov," "Taylor Reed," "Emi Nakamura" — as cover identities.

Never use Google results or ads to find developer tool documentation. Navigate directly to the official vendor's site by typing the URL. The official Claude Code installation guide is at docs.anthropic.com . This campaign specifically purchased advertising to appear above legitimate results; no amount of care when scanning a results page fully protects you.

Inspect any install command before executing it. No legitimate install one-liner should contain &, &&, |, or ; chaining a second command, invoke rundll32.exe or mshta.exe, or load a DLL from a UNC network path beginning with .

Use a clipboard monitoring tool if you work with cryptocurrency. The hijacker in this campaign polls the clipboard 20 times per second and silently swaps wallet addresses before you confirm a transaction.

For enterprise security teams, the researchers recommend deploying application controls and endpoint detection capable of identifying fileless malware activity, enforcing least-privilege access for developer environments, implementing centralized secrets management with continuous scanning for exposed API keys, and establishing governance policies around approved AI tools that provide developers with verified installation sources.

What does fake Claude Code malware steal?

The malware targets AI API keys and authentication tokens from tools like Cline and Continue.dev, browser credentials from more than 65 browsers, cryptocurrency wallet extensions, password manager databases from KeePass, Bitwarden, and 1Password, and messaging app data from Telegram, Discord, and Signal. Stolen API keys can be used for billing fraud, code interception, and access to cloud development environments linked to the compromised account.

How do attackers use Google Ads to spread malware?

How can I tell if a Claude Code installer page is fake?

The only safe source for Claude Code install commands is the official Anthropic documentation at docs.anthropic.com. Before running any install one-liner, check that it does not contain &, |, or ; separators chaining a second command, and does not reference rundll32.exe, mshta.exe, or a UNC network path starting with .

Is this campaign still active?

As of May 14, 2026, researchers at Straiker confirmed that 32 of 88 tracked fake domains were still serving active malware payloads, with ten new domains appearing in the two weeks before that date. No public announcement of a full takedown has been made.