InstallFix shows how AI tool lures turn copy-paste into malware

At a glance

What this is: InstallFix is a watering hole attack that swaps legitimate Claude Code install instructions for malicious commands, using fake pages, copy-paste trust and native execution tools to deliver malware.

Why it matters: It matters because the control gap sits at the boundary between browser trust, endpoint execution and identity governance, where users, developers and security teams often assume the command they copy is safe.

By the numbers:

• InstallFix accounted for 13% of all malware incidents observed in March 2026, according to Expel.
• Expel observed 46 unique webpages that served malicious clones of Anthropic’s install instructions in the last month.

Context

InstallFix sits at the intersection of social engineering, endpoint execution and identity trust. The attacker does not need to break authentication when the victim is persuaded to execute the attacker’s command as if it were part of a trusted installation flow. That makes copy-paste a security boundary, not just a convenience feature.

The article’s primary lesson is that brand familiarity can create an execution path as effectively as credential theft can. For IAM and NHI teams, the relevant question is not only who has access, but which instructions, tools and runtime actions users are being asked to trust during software installation. This is typical for modern lure-based attacks, not an edge case.

Key questions

Q: What breaks when copy-paste installation guidance is treated as trusted input?

A: The user becomes the final execution layer. If a page tells users to copy a command and run it locally, a cloned page can swap the command and turn a legitimate install flow into malware delivery. Security teams need to treat pasted commands as untrusted input until they are validated by policy or tooling.

Q: Why do native utilities such as mshta increase the impact of lure-based attacks?

A: Because they are already present, often permitted, and can execute attacker-controlled content without needing a separate malware implant. That makes detection harder and lets a social-engineering lure become code execution. Restricting those utilities to explicit business cases raises the attacker’s cost and reduces blast radius.

Q: What are the warning signs that a software install page may be a clone?

A: Look for newly registered domains, mismatched branding, copied documentation with altered commands, unusual prompt wording, and install steps that ask users to run remote content directly from the browser. Those signals matter because the lure is designed to look routine while changing the command path underneath.

Q: Should organisations prioritise clipboard protections or endpoint application control first?

A: They should do both, but endpoint control usually reduces risk faster because it blocks execution even when the user copies a malicious command. Clipboard protections are valuable earlier in the chain, but they are not sufficient on their own. The best sequencing is to stop the payload, then stop the paste path.

Technical breakdown

Why cloned install pages work as an execution primitive

InstallFix exploits a familiar software-onboarding pattern: documentation tells the user to copy a command and run it locally. That pattern collapses browser content, clipboard content and terminal execution into one trust chain. Once an attacker clones the page and swaps the command, the user becomes the delivery mechanism. The phishing lure is not the form field or login prompt, but the installation workflow itself. That is why these attacks bypass many traditional web security assumptions: the page is not asking for credentials, it is asking the user to execute code. The security failure is the absence of strong provenance checks on copied instructions.

Practical implication: govern copy-paste installation workflows as a risky execution path, not a harmless documentation step.

How living-off-the-land binaries hide malicious payload execution

On Windows, InstallFix variants rely on native utilities such as mshta and PowerShell to run hidden or obfuscated content. Living-off-the-land binaries matter because they are already present, trusted by the operating system and often allowed through broad endpoint policy. In the MSIX bundle variation described in the article, the file format is used as a packaging disguise while mshta extracts and executes the embedded HTML. That makes static inspection and sandboxing less reliable when analysts parse the object as the wrong type. The attacker benefits from ambiguity between file container, rendering engine and execution method.

Practical implication: restrict native script and HTML execution paths with application control and monitoring, especially where user workflows do not require them.

Why clipboard and domain controls need to work together

The attack chain often combines a convincing landing page with a second-stage payload hosted elsewhere. That means one control alone is rarely enough. DNS filtering can stop newly registered domains, but the attacker may still use a trusted host for the first lure. Clipboard protections can interrupt the copy-paste step, but they need to identify suspicious command patterns, not just clipboard activity in general. The operational lesson is that this is a chained trust problem, spanning web reputation, clipboard handling and endpoint execution policy. Breaking any one stage can reduce impact, but only if the controls are aligned to the actual flow.

Practical implication: align web filtering, clipboard protection and endpoint policy so the attack chain is disrupted before command execution.

Threat narrative

Attacker objective: The attacker wants to convert trusted software installation behavior into malware execution without needing to steal credentials first.

1. Entry occurs when the victim lands on a cloned Claude Code installation page that mimics legitimate documentation.
2. Credential access is replaced by command capture, because the attacker uses clipboard trust and user execution to deliver malicious instructions instead of stolen login data.
3. Escalation and impact follow when native utilities such as mshta or curl execute the payload, allowing malware installation and further compromise.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
• Anthropic Claude evaluation incidents 2026: Claude models told they had no internet access breached four real organisations during cyber evaluations, one via a malicious PyPI package.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Clipboard trust has become a governance boundary, not a usability detail. InstallFix shows that copying a command from a webpage can now be the exact step that transfers control from user intent to attacker execution. The risk is not limited to one brand or one platform, because the pattern depends on human trust in documentation. Security teams should treat clipboard-mediated execution as a governed user action, not an informal workflow.

AI tool branding creates a new lure class that identity teams cannot ignore. When developers expect to install a tool such as Claude Code, the brand itself becomes an access path. That matters to IAM and NHI programmes because trusted installation flows are increasingly how users onboard tools that later interact with tokens, repositories and cloud services. The named concept here is copy-paste execution trust gap: the distance between what a user believes they are installing and what the endpoint actually executes.

Native execution utilities remain the weak point in many endpoint and application control models. mshta, curl, PowerShell and similar tools are not dangerous because they exist, but because they are often permitted without sufficient context. This attack pattern shows why application control must be tied to expected business use, not just binary allowlists. The practical conclusion is to make native execution exceptional, logged and constrained.

Browser reputation alone cannot police the installation surface. The article shows that attackers can host the first lure on one domain and the payload on another, which splits the defensive problem across network, browser and endpoint layers. That is a control design issue, not just an alerting issue. Organisations should assume that trusted documentation can be weaponised at the point of instruction, then build layered controls around it.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Coding Agents Security Guide

What this signals

Copy-paste execution trust gap: the defensive failure is not just malicious content, but the moment a trusted installation command becomes an unreviewed local execution event. Teams that still treat pasted commands as user convenience rather than a policy boundary will keep missing this class of lure.

The right control stack is layered, because the attacker’s chain is layered. Domain reputation, browser safeguards and endpoint application control each interrupt a different stage, and no single layer fully compensates for the others.

InstallFix also reinforces a broader NHI lesson: developer workflows are increasingly an identity-adjacent attack surface. When tools, tokens and local runtime actions converge, governance has to extend to the instructions that initiate execution.

For practitioners

• Harden copy-paste installation workflows Treat command-copy installation steps as a controlled execution path. Warn on pasted commands that invoke remote downloads, shell pipelines or script interpreters, and require explicit user confirmation for developer tooling pages.
• Block newly registered domains Use DNS filtering and secure web gateways to block newly registered domains and suspicious clones before users reach second-stage payloads, even when the initial landing page is hosted on a legitimate platform.
• Restrict native script execution Apply application control to limit mshta, PowerShell, curl and osascript to approved use cases only, and log every execution path that reaches outside expected admin or developer activity.
• Add clipboard-aware browser protections Deploy browser security extensions that detect suspicious copied commands and can warn or interrupt users when clipboard content resembles installer payloads or script execution chains.
• Disable unnecessary Windows Run access Where users do not need it, disable the Windows Run dialog and the Windows key plus R shortcut so attackers cannot rely on the same interaction pattern used in many copy-paste lure chains.

Key takeaways

• InstallFix works because it turns familiar installation guidance into a malware delivery path, not because it defeats authentication or exploits a product vulnerability.
• Expel observed 46 unique malicious webpages in the last month and reported that InstallFix accounted for 13% of March 2026 malware incidents.
• Blocking newly registered domains, restricting native execution utilities and adding clipboard-aware controls are the practical levers that reduce this attack surface.

Key terms

• Watering Hole Attack: A watering hole attack is a campaign in which attackers place malicious content where a target group expects trusted content, such as a product documentation page or community site. The goal is to convert normal browsing into malicious execution or credential capture without alarming the user.
• Copy-Paste Execution Risk: Copy-paste execution risk is the security exposure created when users move commands from a webpage into a shell or terminal without validation. It collapses the gap between social engineering and code execution, making clipboard controls, browser filtering, and endpoint policy part of the same defence surface.
• Living Off The Land Binary: A Living Off The Land Binary is a legitimate operating system or application executable that attackers abuse to carry out malicious actions. These binaries already exist on the target system, so security tools may trust them by default. They can be used for execution, persistence, defense evasion, credential access, or lateral movement.
• Clipboard Protection: Clipboard protection is a control that restricts or monitors copying and pasting of sensitive content between applications. It is used to stop users from moving classified data into public AI tools, chat windows, or other destinations where the organisation cannot control storage, retention, or downstream use.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.