Cybersecuritynews

Fake Claude Code Downloads Spread Infostealer Malware Targeting Developers

First seen 5 Mar 2026, 19:12 UTC • Gbhackers

+16 •63.8

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Cybercriminals are exploiting fake download pages that impersonate Claude Code, a legitimate AI coding assistant, to distribute infostealer malware. Developers and IT professionals are particularly at risk as they may unknowingly download these malicious packages, leading to potential data theft and system compromise.

How this analysis works

Timeline

2026-03-05

Cybercriminals begin using fake Claude Code download pages

2026-03-05

Cybersecurity articles published detailing the threat

Attack Flow

19 entities, 38 inferred relationships (STIX 2.1).

Technique (8)

Malware
T1036 - Masquerading
T1059.001 - PowerShell
T1059.003 - Windows Command Shell
T1059.004 - Unix Shell
T1105 - Ingress Tool Transfer
T1189 - Drive-by Compromise
T1218.005 - Mshta

Campaign (1)

InstallFix

Malware (3)

ClickFix
ACR Stealer
Amatera Stealer

Affected Platform (5)

Cloudflare Pages
MacOS
Squarespace
Tencent EdgeOne
Windows

Tool (2)

Curl
Mshta.exe

Relationships

InstallFix uses ClickFix
InstallFix uses ACR Stealer
InstallFix uses Amatera Stealer
Malware targets Cloudflare Pages
Malware targets MacOS
Malware targets Squarespace
Malware targets Tencent EdgeOne
T1036 - Masquerading targets Cloudflare Pages
T1036 - Masquerading targets MacOS
T1036 - Masquerading targets Squarespace
T1036 - Masquerading targets Tencent EdgeOne
T1059.001 - PowerShell targets Cloudflare Pages
T1059.001 - PowerShell targets MacOS
T1059.001 - PowerShell targets Squarespace
T1059.001 - PowerShell targets Tencent EdgeOne
T1059.003 - Windows Command Shell targets Cloudflare Pages
T1059.003 - Windows Command Shell targets MacOS
T1059.003 - Windows Command Shell targets Squarespace
T1059.003 - Windows Command Shell targets Tencent EdgeOne
T1059.004 - Unix Shell targets Cloudflare Pages
T1059.004 - Unix Shell targets MacOS
T1059.004 - Unix Shell targets Squarespace
T1059.004 - Unix Shell targets Tencent EdgeOne
T1105 - Ingress Tool Transfer targets Cloudflare Pages
T1105 - Ingress Tool Transfer targets MacOS
T1105 - Ingress Tool Transfer targets Squarespace
T1105 - Ingress Tool Transfer targets Tencent EdgeOne
T1189 - Drive-by Compromise targets Cloudflare Pages
T1189 - Drive-by Compromise targets MacOS
T1189 - Drive-by Compromise targets Squarespace
T1189 - Drive-by Compromise targets Tencent EdgeOne
T1218.005 - Mshta targets Cloudflare Pages
T1218.005 - Mshta targets MacOS
T1218.005 - Mshta targets Squarespace
T1218.005 - Mshta targets Tencent EdgeOne
InstallFix related to Windows
InstallFix related to Curl
InstallFix related to Mshta.exe

Continue Reading

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts ACSC Issues Critical Alert on Exploited CMS Vulnerabilities Cybercriminals Exploit BNB Chain for Malware via Fake CAPTCHAs

Fake Claude Code Downloads Spread Infostealer Malware Targeting Developers

Article Content

Timeline

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading