Threat Intelligence Report

Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer

📅 June 9, 2026 📰 www.cyderes.com 🔍 0 CVE(s) referenced

A sophisticated SEO poisoning campaign is targeting new Claude Code users with a fake installer that leverages a multi-stage, fileless attack chain—culminating in a reflective .NET infostealer that exfiltrates credentials to Russian infrastructure, all while evading traditional detection and rendering static indicators nearly useless.

unclassified

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle