INSTALLFIX: HOW ATTACKERS ARE WEAPONIZING MALVERTIZED INSTALL GUIDES

Summary from the TLDR InfoSec newsletter

Attackers are cloning installation pages for popular developer tools like Claude Code and using Google Ads to place these lookalike sites above legitimate results, leading users to run malicious “curl | shell” one‑liners that pull Amatera Stealer and related payloads from attacker‑controlled infrastructure. The campaign abuses legitimate hosting and rapidly rotated domains to evade detection, while redirections back to real sites reduce victim suspicion. For defenders, what matters is reducing blind trust in install commands, hardening controls around malvertising-driven traffic, and detecting browser-based signals such as lookalike domains, copy-to-clipboard shell commands, and suspicious script execution chains in real time.