InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise

May 5, 2026 · Trend Micro · Severity: HIGH

Targeting multiple industries worldwide, the InstallFix campaign uses fake Claude AI installer pages to trick users into running malware that collects system information, disables security features, achieves persistence, and connects to attacker-controlled C&C servers for additional payloads.

Key Takeaways

The InstallFix campaign targets multiple industries worldwide using fake Claude AI installer pages to trick users into running malware.
The malware collects system information, disables security features, achieves persistence, and connects to attacker-controlled C2 servers for additional payloads.
Users should download AI tools only from official vendor sites and verify installer integrity, since fake install pages lead to real compromise.