Fake Claude Code sites spread malware through cloned install guides targeting developers
Cybercriminals are cloning Claude Code installation pages to distribute malware through Google search ads. The scam, called InstallFix by Push Security, replaces legitimate download commands with malicious ones that install Amatera Stealer, harvesting passwords and session tokens. The fake sites appear nearly identical to the real thing, making them difficult to spot.