Dubbed InstallFix by Push Security, the scheme inserts instructions to download malware during the Claude Code install process on cloned websites.
InstallFix delivers an infostealer to your device.
A newly discovered InstallFix campaign relies on malicious commands on cloned installation webpages to trick victims into installing malware.