Notifications
Clear all
Topic starter
19/08/2026 3:37 pm
TL;DR: A watering hole attack called InstallFix is using fake Claude Code install pages to trick users into running malicious commands, with 46 unique webpages observed in the last month and 13% of March 2026 malware incidents attributed to the technique, according to Expel. The pattern shows how AI-tool branding, clipboard trust, and native OS utilities can combine into an execution path that identity and endpoint teams need to govern more tightly.
NHIMG editorial — based on content published by Expel: LLMjacking and InstallFix analysis focused on Claude Code lure abuse and malicious install pages
By the numbers:
- InstallFix accounted for 13% of all malware incidents Expel observed in March 2026.
- Expel observed 46 unique webpages serving malicious clones of Anthropic’s install instructions in the last month.
- URLScan Pro found 94 scans from users across 30 unique domains tied to the cloning activity.
Questions worth separating out
Q: How should security teams stop copy-paste malware from software install pages?
A: Treat install instructions as an execution control problem.
Q: Why do watering hole attacks still work against experienced users?
A: They work because they exploit trusted workflows rather than obvious deception.
Q: What do organisations get wrong about blocking malicious install pages?
A: Many teams focus only on the landing page and miss the second-stage payload domain, the clipboard step, and the native utility used to run the code.
Practitioner guidance
- Block newly registered domains at the edge Configure DNS filtering and secure web gateways to deny newly registered domains, especially when they host installation content or second-stage payloads.
- Restrict risky native utilities by policy Use Windows Defender Application Control on Windows and EDR or MDM policy on macOS to limit mshta, PowerShell, curl, and osascript to approved use cases.
- Inspect clipboard-to-shell transfers Deploy browser extensions or endpoint controls that flag suspicious copied commands before they are pasted into a terminal.
What's in the full article
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact InstallFix lure patterns observed across cloned Claude Code pages and related domains.
- The msIX bundle and HTML-in-file variation used to evade analysis on Windows systems.
- The macOS and Windows-specific mitigation paths, including how the controls differ by platform.
- The indicators of compromise published by Expel for teams doing detection and hunting.
👉 Read Expel's analysis of InstallFix and Claude Code copy-paste malware →
InstallFix and Claude Code lures: are copy-paste controls keeping up?
Explore further
19/08/2026 4:17 pm
Copy-paste trust has become a governance problem, not just a user-training problem: InstallFix shows that the browser-to-terminal path is now a control surface. Traditional awareness training is insufficient when the attack uses legitimate product branding, familiar installation steps, and native tools to reach execution. The real issue is whether an organisation can govern what code may be copied from the web and executed on an endpoint.
A question worth separating out:
Q: Should teams disable utilities like mshta and osascript by default?
A: Yes, unless there is a clear business use case. These tools are powerful precisely because they are native and trusted, which makes them attractive to attackers. If they are not required for most users, disabling or tightly restricting them reduces the chance of living off the land abuse.
👉 Read our full editorial: InstallFix shows how AI tool lures turn copy-paste into malware
