Attackers are evolving social engineering tactics with a new technique called InstallFix, designed to trick users into running malicious commands under the guise of installing legitimate command‑line interface (CLI) tools.
How InstallFix Works
- Cloned pages: Threat actors create near‑perfect replicas of popular CLI tool documentation sites, such as Anthropic’s Claude Code.
- Malicious instructions: While the layout and links appear authentic, the installation commands for macOS and Windows are altered to fetch malware from attacker‑controlled domains.
- Malvertising campaigns: These fake pages are promoted through Google Ads, ensuring they appear at the top of search results for queries like “Claude Code install.”
- Seamless deception: Victims who follow the instructions continue to see legitimate links and documentation, making it difficult to realize they’ve been compromised.
The Payload: Amatera Stealer
- Delivery method:
- macOS: Base64‑encoded commands download and execute binaries.
- Windows: Uses legitimate utilities like mshta.exe and conhost.exe to retrieve and run malware.
- Capabilities:
- Steals browser passwords, cookies, and session tokens.
- Collects system information.
- Targets cryptocurrency wallets.
- Origins: Believed to be based on ACR Stealer, sold as a Malware‑as‑a‑Service (MaaS) subscription.
Why It Matters
- Developer habits exploited: The widespread use of “curl‑to‑bash” shortcuts makes InstallFix highly effective.
- Broader user base: Non‑technical users increasingly rely on CLI tools, expanding the attack surface.
- Legitimate hosting: Malicious sites are deployed on trusted platforms like Cloudflare Pages, Squarespace, and Tencent EdgeOne, complicating detection.
Defensive Recommendations
- Verify sources: Always obtain installation instructions directly from official websites.
- Avoid promoted results: Block or skip sponsored search results when downloading CLI tools.
- Bookmark trusted portals: Maintain a list of verified download sources for frequently used tools.
- Monitor IoCs: Use indicators of compromise published by Push Security to detect malicious domains and payloads.
- Educate teams: Train developers and non‑technical staff on the risks of blindly executing installation scripts.
Final Thought
InstallFix demonstrates how attackers are weaponizing trust in developer workflows. By cloning documentation and exploiting shortcuts, they deliver powerful infostealers like Amatera with minimal friction. For IT leaders, the lesson is clear: security awareness must extend beyond traditional phishing to include developer practices and CLI tool installations.
Leave a Reply