Fake Claude Code Install Guides Spread Amatera Infostealer in New “InstallFix” Malvertising Campaign

Cybersecurity researchers identified a malware campaign where attackers mimic legitimate command-line installation guides for developer tools. The campaign uses the "InstallFix" technique, a variant of the ClickFix social engineering method, to deceive users into running malicious terminal commands. Attackers clone real CLI installation pages and embed harmful commands disguised as official setup instructions. Victims who follow these steps unknowingly install the Amatera infostealer, which steals credentials and sensitive system data.