FAKE CLAUDE CODE SITE DROPS AMATERA INFOSTEALER VIA ONE‑LINE INSTALLS
A convincing fake Claude Code website is tricking developers into installing the Amatera infostealer via copy-paste CLI commands. Attackers cloned Anthropic’s ...
A convincing fake Claude Code website is tricking developers into installing the Amatera infostealer via copy-paste CLI commands.
Attackers cloned Anthropic’s Claude Code site so well that every link routes to the real product, except the one-line install command. Paste it into macOS, PowerShell, or CMD and you get malware instead, a pattern dubbed InstallFix. The payload here is Amatera, which steals browser passwords, session tokens, autofill data, and crypto wallets, and the pages may be hosted on legitimate platforms like Cloudflare Pages and Squarespace Lifehacker.
This targets the dev habit of copying shell installers from docs, turning a moment of inattention into code execution. If your team uses Claude Code or similar tools, verify domains, avoid curl | sh installers, prefer signed packages, and pin install steps in internal docs. WebProNews has a solid overview of the clone and workflow risks WebProNews.
Developer workstations hold repo creds and session tokens; an infostealer there can cascade into source, CI, and cloud compromise.
The attack piggybacks on normal CLI install habits, so traditional email or browser filters may never trigger.
-
terminal
Run a tabletop: can engineers distinguish the real Claude Code domain and installer from a pixel-perfect clone, and do they verify checksums or signatures?
-
terminal
Attempt to install via curl | sh from a non-allowlisted domain on a managed laptop and confirm your controls block or flag it.
Legacy codebase integration strategies...
- 01.
Add an allowlist for installer domains and enforce package-manager-only installs for dev tools across macOS and Windows endpoints.
- 02.
Update onboarding docs to pin vetted install commands and require checksum/signature verification; remove any one-liners that pipe to shell.
Fresh architecture paradigms...
- 01.
Ship internal tools via signed packages in official repos (Homebrew, winget, apt) instead of copy-paste installers.
- 02.
Bake in workstation hardening: least-privilege local accounts, EDR that flags script-from-web execution, and DNS filtering for lookalike domains.