Topic starter
19/08/2026 3:37 pm
TL;DR: A watering hole attack called InstallFix is using fake Claude Code install pages to trick users into running malicious commands, with 46 unique webpages observed in the last month and 13% of March 2026 malware incidents attributed to the technique, according to Expel. The pattern shows how AI-tool branding, clipboard trust, and native OS utilities can combine into an execution path that identity and endpoint teams need to govern more tightly.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “InstallFix: Not the application you were looking for”.
By the numbers:
- InstallFix accounted for 13% of all malware incidents observed in March 2026, according to Expel.
- Expel observed 46 unique webpages that served malicious clones of Anthropic’s install instructions in the last month.
Key questions
Q: What breaks when copy-paste installation guidance is treated as trusted input?
A: The user becomes the final execution layer.
Q: Why do native utilities such as mshta increase the impact of lure-based attacks?
A: Because they are already present, often permitted, and can execute attacker-controlled content without needing a separate malware implant.
Q: What are the warning signs that a software install page may be a clone?
A: Look for newly registered domains, mismatched branding, copied documentation with altered commands, unusual prompt wording, and install steps that ask users to run remote content directly from the browser.
Practitioner guidance
- Harden copy-paste installation workflows Treat command-copy installation steps as a controlled execution path.
- Block newly registered domains Use DNS filtering and secure web gateways to block newly registered domains and suspicious clones before users reach second-stage payloads, even when the initial landing page is hosted on a legitimate platform.
- Restrict native script execution Apply application control to limit mshta, PowerShell, curl and osascript to approved use cases only, and log every execution path that reaches outside expected admin or developer activity.
Bottom line: InstallFix works because it turns familiar installation guidance into a malware delivery path, not because it defeats authentication or exploits a product vulnerability.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:17 pm
Clipboard trust has become a governance boundary, not a usability detail. InstallFix shows that copying a command from a webpage can now be the exact step that transfers control from user intent to attacker execution. The risk is not limited to one brand or one platform, because the pattern depends on human trust in documentation. Security teams should treat clipboard-mediated execution as a governed user action, not an informal workflow.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: Should organisations prioritise clipboard protections or endpoint application control first?
A: They should do both, but endpoint control usually reduces risk faster because it blocks execution even when the user copies a malicious command. Clipboard protections are valuable earlier in the chain, but they are not sufficient on their own. The best sequencing is to stop the payload, then stop the paste path.
👉 Read our full editorial: InstallFix shows how AI tool lures turn copy-paste into malware