Fake Claude Install Page Delivers Fileless .NET Infostealer

Key Takeaways

• A sophisticated SEO poisoning campaign is luring users searching for “Claude Code install” to fake Anthropic download pages.
• The attack chain utilizes a multi-stage, primarily fileless .NET infostealer designed to evade detection by common security tools.
• The malware exfiltrates sensitive credentials to Russian-hosted command and control infrastructure.
• The campaign specifically targets less technically savvy users, such as first-time developers, who may be less familiar with legitimate software installation processes.

Cybercriminals Leverage Fake Claude Code Install Page to Deliver Fileless .NET Infostealer

Cybersecurity researchers have uncovered an active campaign exploiting the burgeoning interest in AI coding tools by distributing a stealthy, fileless .NET infostealer. The attackers are employing search engine optimization (SEO) poisoning to direct unsuspecting users, particularly those seeking installation guides for Anthropic’s Claude Code, to deceptive download pages.

This elaborate threat, detailed in a recent report by Cyderes’ threat research unit, Howler Cell, highlights a growing trend of adversaries capitalizing on popular software adoption to compromise user credentials and sensitive information. The campaign is notable for its six-stage delivery chain, which remains almost entirely fileless after the initial infection vector, making detection exceptionally challenging.

Targeting Novice Users with Deceptive Tactics

The attackers have meticulously designed this campaign to target a specific demographic: first-time developers and non-technical users eager to experiment with new AI tools. These individuals often lack the foundational knowledge to differentiate a legitimate software installation process from a malicious one, making them highly susceptible to social engineering tactics.

According to the Cyderes report shared with Cyber Security News (CSN), the attackers manipulate search results to position a spoofed Anthropic installation page prominently. Once on this page, victims are instructed to execute a malicious MSHTA command via the Windows Run dialog, a technique dubbed “ClickFix” that disguises attacker-controlled commands as routine setup steps.

The ultimate objective is to deploy a reflective .NET infostealer that communicates with Russian infrastructure to exfiltrate stolen credentials. The consequences for infected individuals are severe, ranging from compromised accounts and drained financial resources to complete identity theft, particularly as many victims operate without robust enterprise-level security controls.

It is crucial to note that Anthropic’s systems remain uncompromised; its brand is merely being impersonated by the attackers as part of this sophisticated phishing and malware distribution scheme.

Multi-Stage, Fileless Execution Evades Detection

The campaign’s efficacy stems from its meticulously engineered delivery chain, designed to bypass various security measures, including file inspection, AMSI scanning, EDR telemetry, sandbox analysis, and traditional IOC matching at multiple layers.

The attack initiates when a user, searching for “Claude Code install,” clicks on what appears to be an official Anthropic setup page. This page then directs the user to open the Windows Run dialog and paste a pre-staged mshta.exe command, presented as a necessary step for installation.

Stage 1: Polyglot Payload Delivery

The mshta.exe command retrieves a 6.7 MB MP3/HTA polyglot payload from download.version-516[.]com/claude. This file is crafted to appear as playable audio during security scans while covertly embedding an executable HTA script block. While media players like VLC would recognize it as a legitimate MP3, mshta.exe processes the file, ignores the audio data, and executes the hidden script.

Stage 2 & 3: PowerShell and In-Memory Script Execution

The HTA script then proceeds to register a scheduled task via a COM object, which in turn spawns a 32-bit PowerShell process. The choice of a 32-bit PowerShell binary is strategic, as many EDR solutions prioritize monitoring 64-bit activities. This PowerShell script performs an AMSI bypass, RC4 decryption, and victim fingerprinting using an MD5 hash of the machine and username.

Stage 3 sees the PowerShell process fetching a substantial 17 MB obfuscated script directly into memory from a unique subdomain on oakenfjrod[.]ru. This critical step ensures that no malicious files are written to disk, significantly hindering forensic analysis and traditional file-based detection.

Reflective .NET Infostealer: The Final Payload

The culmination of the attack is the deployment of a reflective .NET infostealer. This final payload executes entirely within the existing PowerShell process’s address space, mirroring advanced techniques typically seen in sophisticated tools like Cobalt Strike but implemented fully through PowerShell. This method ensures there are no new process spawns, no file artifacts, and no image-load events for defenders to detect.

Once active, the infostealer communicates over HTTPS to 185[.]177[.]239[.]255:443 for command and control (C2) and exfiltration of stolen credentials. Cyderes’ analysis, utilizing “SensitiveFileRead” telemetry, confirmed the malware’s access to browser credential stores during its execution.

Detection of such advanced fileless threats often relies on EDR platforms with granular visibility into .NET assembly loads, as traditional file-based security controls are ineffective. Organizations should consider any Claude Code installation page that instructs users to paste commands into the Windows Run dialog as a high-risk indicator of compromise.

What You Should Do

• Verify Software Sources: Always download software directly from official vendor websites. Be wary of third-party download sites or search results that appear suspicious.
• Educate Users: Train users, especially those new to development tools, on identifying phishing attempts and the dangers of executing commands from unverified sources. Emphasize that legitimate software installations rarely require pasting commands into the Windows Run dialog.
• Implement Network Restrictions: Block outbound HTTPS connections from mshta.exe unless explicitly required and carefully monitored.
• Monitor DNS and Network Traffic: Implement wildcard domain blocking for suspicious domains like oakenfjrod[.]ru. Monitor DNS queries and network traffic for connections to known malicious IPs, such as 185[.]177[.]239[.]255.
• Enhance EDR Visibility: Ensure your Endpoint Detection and Response (EDR) solutions have robust visibility into .NET assembly loads and PowerShell activity to detect fileless attacks.
• Use Multi-Factor Authentication (MFA): Enable MFA on all accounts, especially for critical services, to add an extra layer of security against stolen credentials.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.