A little help from your search engine. [Research Saturday]

Today we are joined by Brian Hussey (linkedin.com/in/brianhussey), SVP of Howler Cell Threat Services at Cyderes (cyderes.com), discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA command.

The attack uses a six-stage, largely fileless chain that employs an MP3/HTA polyglot, PowerShell obfuscation, AMSI bypasses, per-victim infrastructure, and in-memory execution to evade detection. The final payload is a .NET infostealer that steals credentials, while Anthropic and the legitimate Claude Code installation process were not compromised.

The research and executive brief can be found here:

• Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer (cyderes.com/howler-cell/fake-claude-code-insta…)

Learn more about your ad choices. Visit megaphone.fm/adchoices