← Back to Feed
InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
May 5, 2026 · Sophos Threat Research · Severity: HIGH
<p>Multiple legitimate DFIR tools abused by GOLD EMBRACE double-extortion.
Key Takeaways
- Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users.