Scammers are buying search ads for fake Claude Code and ChatGPT install pages that look like the vendor's docs but tell you to paste a malicious command into your terminal. Anyone installing an AI coding tool by searching for it is exposed. The fix is simple: take install commands only from the vendor's own documentation, never from an ad or a search result you did not verify.
TL;DR
| Question | Answer |
|---|---|
| Am I affected? | Only if you ran an install command from a page reached through a search ad or lookalike domain. |
| Is there a fix? | There is no software patch; this is social engineering. Reinstall from the official docs and rotate secrets if you ran a suspect command. |
| Does data leave my machine? | The malware families in these campaigns are infostealers, so credentials, keychain data and wallets can. |
| Can Beam help? | Partly. It can scan agent config files and flag risky agent actions, but it does not see commands you type yourself. |
What the researchers found
Graphika reported a spike in fraudulent ads in April 2026 for keywords such as "get claude code" and "claude design". The ads used verified Google Ads accounts, which Graphika says "build an appearance of credibility", and sent victims to pages "hard to distinguish from the real company's pages". An earlier campaign in late 2025 used about 400 ads for a fake ChatGPT Atlas browser.
The Cloud Security Alliance research note groups the activity into three patterns: typosquatted packages in registries, cloned "InstallFix" pages distributed through search ads, and malicious lures hosted on legitimate AI platforms.
How the lure works, step by step
- You search for how to install Claude Code and click a sponsored result.
- The page mirrors Anthropic's documentation but replaces the install command. Graphika describes
curl-to-bashterminal commands, and a PowerShell command on a page aimed at Windows users. - You paste it. On Windows the CSA note describes a chain from
cmd.exetomshta.exeto remote HTML. - An infostealer runs. The CSA note names Amatera Stealer in the InstallFix campaign and MacSync, which targets the macOS Keychain, browser credentials and wallets.
The note also reports that attackers published terminal-command lures as Claude artifacts on claude.ai, so the domain itself looked trustworthy. It says more than 10,000 users accessed those artifacts before removal. Graphika lists indicators including claude-code-macos[.]com and a GitLab-hosted page mimicking Anthropic branding.
What this means if you run AI coding agents
- Check your source. Reinstall only from Anthropic's documentation, reached by typing the address, not through an ad. Treat search results as unverified, as Graphika advises.
- Read before you pipe. A one-line
curl ... | bashruns whatever the server returns. Download the script and read it first. - If you ran a suspect command, assume exposure. From a clean device, rotate API keys, cloud tokens, SSH keys and browser-saved passwords.
- Audit agent configs. The CSA note recommends reviewing MCP server configurations in every AI coding tool and treating unrecognized entries as possible compromise indicators. Its SANDWORM_MODE example is an npm worm that injected rogue MCP entries into Claude Code, Cursor and other tools' configs; see our coverage of npm worms targeting AI tooling.
- Verify package names. The note cites research that about 20% of generated code samples referenced nonexistent packages, and that attackers can register those names.
What Beam can and cannot do here
Beam cannot stop you from pasting a command into your own shell, and it is not a kernel sandbox. What it can do, per its docs, is run offline heuristic checks with beam scan .mcp.json --mcp, which validates MCP JSON and examines version pinning, so you can inspect a config you are unsure about. For actions taken by Claude Code or Codex, hook-based deny can block risky commands before they run, as covered in stopping dangerous Claude Code commands. Scanning is heuristic, not semantic malware analysis. Everything stays on your device; see how Beam stays local.
For more context, read our MCP security guide and agent supply-chain security overview.
Frequently asked questions
What is InstallFix?
InstallFix is a lure where a cloned install page looks like a vendor's documentation but swaps the legitimate install command for a malicious one. The Cloud Security Alliance describes it for Claude Code, alongside the related ClickFix technique.
How do I know my Claude Code install is genuine?
Check where you got the command. Only copy install steps from Anthropic's own documentation, typed into the address bar rather than reached through a search ad, and run claude --version to confirm the binary responds as expected.
What should I do if I ran a command from a lookalike page?
Treat the machine as compromised. Rotate API keys, tokens, SSH keys and browser-stored credentials from a clean device, and review your MCP and agent config files for entries you did not add.
Can Beam block a malicious install command?
Not one you type yourself in a terminal. Beam watches what supported agents do and can deny risky actions through Claude Code and Codex hooks, but it is not a kernel sandbox and does not inspect commands you run outside an agent.
Are AI-suggested package names a related risk?
Yes. The CSA note describes slopsquatting, where attackers register package names that language models hallucinate, so verify every suggested name against the registry before installing.
Details reflect the cited reports as of October 16, 2026. Campaign domains rotate quickly, so check the sources for current indicators.