InstallFix shows how AI tool lures turn copy-paste into malware

At a glance

What this is: InstallFix is a watering hole attack that swaps legitimate Claude Code installation instructions for malicious commands, turning trusted copy-paste behaviour into code execution.

Why it matters: It matters because AI tool lures exploit the gap between user trust, endpoint controls, and identity-adjacent execution paths, which affects both human users and the systems they operate.

By the numbers:

• InstallFix accounted for 13% of all malware incidents Expel observed in March 2026.
• Expel observed 46 unique webpages serving malicious clones of Anthropic’s install instructions in the last month.
• URLScan Pro found 94 scans from users across 30 unique domains tied to the cloning activity.

👉 Read Expel's analysis of InstallFix and Claude Code copy-paste malware

Context

InstallFix is a copy-paste malware pattern, not a software bug in Claude Code itself. Attackers clone a trusted installation page, replace the legitimate command with one that pulls down and runs malicious code, and rely on users to execute it inside a terminal.

The security gap is behavioural trust combined with weak controls around what can be copied, pasted, and executed on endpoints. That makes this relevant to IAM and NHI teams as well, because the same trust failure that affects users also affects the tools, scripts, and automation identities that now dominate modern environments.

Key questions

Q: How should security teams stop copy-paste malware from software install pages?

A: Treat install instructions as an execution control problem. Block newly registered domains, inspect clipboard content before paste, and restrict native tools such as mshta, curl, and PowerShell where users do not need them. Training helps, but policy enforcement and endpoint controls stop the handoff from lure to code execution.

Q: Why do watering hole attacks still work against experienced users?

A: They work because they exploit trusted workflows rather than obvious deception. If the page looks like official documentation and the command appears normal, even experienced users may copy and run it without scrutiny. The attacker only needs one successful paste to convert trust into execution.

Q: What do organisations get wrong about blocking malicious install pages?

A: Many teams focus only on the landing page and miss the second-stage payload domain, the clipboard step, and the native utility used to run the code. Effective defence has to cover the whole chain, from domain reputation and web filtering to application control on the endpoint.

Q: Should teams disable utilities like mshta and osascript by default?

A: Yes, unless there is a clear business use case. These tools are powerful precisely because they are native and trusted, which makes them attractive to attackers. If they are not required for most users, disabling or tightly restricting them reduces the chance of living off the land abuse.

Technical breakdown

How watering hole lures turn install trust into execution

A watering hole attack works by placing a malicious page where the target expects a legitimate one. In this case, the lure is a software install page that instructs users to copy a command into a terminal. The attack succeeds because the user is not asked to authenticate to the attacker, only to trust the command path. That makes the browser, clipboard, shell, and endpoint a single execution chain. The malicious site may clone the branding of the real product and host the payload on a different domain, which helps evade casual inspection.

Practical implication: Block newly registered domains and treat terminal copy-paste from web pages as a controlled execution path, not a user convenience.

Why mshta, curl, and other living off the land tools matter

InstallFix variations use native utilities such as mshta on Windows or curl and osascript on macOS because those tools are already present and often trusted by the operating system. mshta is especially useful to attackers because it can extract and execute HTML content hidden inside a file that appears to be something else. That creates an anti-analysis layer, since sandboxes and parsers may interpret the file differently from the runtime. The real risk is not the file extension alone but the execution context the tool creates.

Practical implication: Use application control and endpoint policy to restrict shell and script utilities that normal users do not need.

Why clipboard protections and browser controls close part of the gap

Copy-paste attacks depend on the user moving attacker-supplied code from the browser into a shell. Clipboard protections can inspect copied text, warn on suspicious command strings, or stop dangerous pastes before execution. That does not eliminate social engineering, but it breaks the most efficient handoff between lure and payload. On macOS and Windows, this kind of control matters because the attack often looks like normal installation behaviour rather than obvious malware delivery.

Practical implication: Add clipboard inspection and browser-side warnings where users routinely copy commands from documentation pages.

Threat narrative

Attacker objective: The attacker wants to turn trusted installation behaviour into initial code execution on the endpoint and use that foothold for compromise or further malware delivery.

1. Entry begins with a cloned software installation page that users reach through brand impersonation or a lookalike domain.
2. Escalation occurs when the user pastes and executes a malicious command that retrieves a second-stage payload through native tools such as mshta or curl.
3. Impact is endpoint compromise on Windows or macOS, with potential follow-on credential theft, persistence, or broader malware deployment.

NHI Mgmt Group analysis

Copy-paste trust has become a governance problem, not just a user-training problem: InstallFix shows that the browser-to-terminal path is now a control surface. Traditional awareness training is insufficient when the attack uses legitimate product branding, familiar installation steps, and native tools to reach execution. The real issue is whether an organisation can govern what code may be copied from the web and executed on an endpoint.

AI tool branding is creating a new class of lureable execution paths: The article shows how attacker use of Claude Code-style instructions makes the lure feel operational rather than suspicious. That matters because AI development and automation workflows increasingly depend on terminals, scripts, and credentials, which means the same human click can expose both endpoint and identity assets. Organisations should treat AI tool installation flows as part of identity-adjacent runtime governance.

Living off the land abuse remains effective because many environments still trust the default toolset: mshta, curl, and osascript are not malicious by themselves, but they become control bypasses when policy assumes legitimate software use. This is where least privilege, application control, and telemetry need to align. If a normal user does not need these tools, they should not be freely available.

Clipboard inspection is an underused control for modern social engineering: The attack chain depends on the user carrying attacker-controlled text into execution. That makes the clipboard a policy boundary, not just a transient buffer. Teams that ignore it will keep relying on post-execution detection instead of preventing the handoff that makes the attack reliable. The named concept here is copy-paste execution risk, and it deserves explicit governance.

What this signals

Copy-paste execution risk should now be treated as part of endpoint governance and identity-adjacent workflow control. Where developers and operators install tools from the web, browser policy, clipboard inspection, and application control become the practical boundary between safe usage and code execution.

The wider signal for security teams is that AI tool adoption is creating more trusted execution surfaces, not fewer. That reinforces the need to map terminal usage, script utilities, and any workflow that handles credentials or tokens to a tighter policy model, especially where service accounts and automation identities are already in play.

For practitioners

• Block newly registered domains at the edge Configure DNS filtering and secure web gateways to deny newly registered domains, especially when they host installation content or second-stage payloads. This reduces the chance that users reach a cloned page or the payload domain behind it.
• Restrict risky native utilities by policy Use Windows Defender Application Control on Windows and EDR or MDM policy on macOS to limit mshta, PowerShell, curl, and osascript to approved use cases. Allow them only where a documented business need exists.
• Inspect clipboard-to-shell transfers Deploy browser extensions or endpoint controls that flag suspicious copied commands before they are pasted into a terminal. Focus on workflows where users regularly copy install instructions from public documentation.
• Disable unnecessary run and paste shortcuts Remove or constrain Windows Run access and other shortcut-driven execution paths for user groups that do not need them. Reducing one-step execution opportunities makes copy-paste lures less effective.
• Monitor for install-page impersonation Watch for lookalike domains, cloned documentation pages, and branding reuse around popular developer tools. Tie that monitoring to threat intel and web filtering so suspicious pages are blocked before execution begins.

Key takeaways

• InstallFix works because it turns a legitimate install workflow into a code-execution trap, not because it defeats the operating system outright.
• The observed scale, including 46 malicious clone pages and 13% of March 2026 malware incidents, shows that the pattern is already operationally relevant.
• Blocking new domains, restricting native utilities, and controlling clipboard-to-shell transfers are the controls that change the outcome.

Key terms

• Watering Hole Attack: A watering hole attack is a campaign in which attackers place malicious content where a target group expects trusted content, such as a product documentation page or community site. The goal is to convert normal browsing into malicious execution or credential capture without alarming the user.
• Copy-Paste Execution Risk: Copy-paste execution risk is the security exposure created when users move commands from a webpage into a shell or terminal without validation. It collapses the gap between social engineering and code execution, making clipboard controls, browser filtering, and endpoint policy part of the same defence surface.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.
• Clipboard Inspection: Clipboard inspection is a control that examines text copied by a user before it is pasted or executed. In modern phishing and copy-paste malware campaigns, it can detect suspicious commands, block risky pastes, and reduce the chance that a browser lure becomes terminal execution.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact InstallFix lure patterns observed across cloned Claude Code pages and related domains.
• The msIX bundle and HTML-in-file variation used to evade analysis on Windows systems.
• The macOS and Windows-specific mitigation paths, including how the controls differ by platform.
• The indicators of compromise published by Expel for teams doing detection and hunting.

👉 Expel's full post covers the lure variants, platform-specific abuse, and indicators of compromise.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity control to real-world attack paths and operational risk.