Executive Summary
The InstallFix campaign (also known as the Fake Claude Installer threat) is a sophisticated social engineering operation targeting users searching for Anthropic’s Claude AI assistant. Attackers use malicious Google Ads to drive traffic to fraudulent landing pages that mimic legitimate developer documentation. These pages trick users into executing PowerShell commands that initiate a multi-stage infection chain using polyglot files and system binary proxy execution to deliver the RedLine Stealer malware.
The attack is notable for its technical evasion techniques, including the use of ZIP/HTA polyglots to bypass static analysis, AMSI patching in memory, and the generation of victim-unique C2 subdomains based on machine fingerprints. By impersonating high-demand AI tools, the campaign effectively targets a broad spectrum of victims across government, electronics, and education sectors.
While the primary goal is credential and data theft via RedLine Stealer, the modular nature of the delivery mechanism—utilizing scheduled tasks for persistence and fileless memory execution—poses a significant risk for further payload deployment. Organizations in the Americas, AMEA, and Europe should prioritize monitoring for anomalous MSHTA and PowerShell process behaviors.