{"id":13370,"date":"2026-06-04T10:03:41","date_gmt":"2026-06-04T10:03:41","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/04\/fake-claude-code-installer-via-google-sites-deliver-credential-stealing-malware\/"},"modified":"2026-06-04T10:03:41","modified_gmt":"2026-06-04T10:03:41","slug":"fake-claude-code-installer-via-google-sites-deliver-credential-stealing-malware","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/04\/fake-claude-code-installer-via-google-sites-deliver-credential-stealing-malware\/","title":{"rendered":"Fake Claude Code Installer Via Google Sites Deliver Credential-Stealing Malware"},"content":{"rendered":"

Fake Claude Code Installer Via Google Sites Deliver Credential-Stealing Malware
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybercriminals have found a new and clever way to exploit the growing popularity of AI developer tools. <\/p>\n

A recently identified campaign uses fake pages mimicking Claude Code and OpenAI Codex, hosted on trusted Google Sites infrastructure, to trick users into running commands that quietly steal their credentials and other sensitive personal data from their devices.<\/a><\/p>\n

The attack follows a technique known as ClickFix, where victims are shown what looks like a legitimate setup page and told to execute a short command. <\/p>\n

There is no file downloaded in the traditional sense. Instead, the entire malicious operation runs silently in memory, making it much harder for standard security tools to catch it in the act.<\/a><\/a><\/p>\n

Analysts at ANY.RUN said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that they identified this active ClickFix campaign impersonating popular AI tools, including both Codex and Claude. <\/p>\n

The researchers noted that because network activity appears as normal PowerShell traffic, the attack can significantly reduce visibility during the earliest stages of a system compromise.<\/a><\/p>\n

What makes this campaign stand out is how well it blends in. Google Sites pages carry the trust of a legitimate Google domain, and most users would not think twice before following instructions on such a page. <\/p>\n

\n

\n
\n
\n
\n

\"\ud83d\udea8\" \ud835\uddd9\ud835\uddee\ud835\uddf8\ud835\uddf2 \ud835\uddd6\ud835\uddf9\ud835\uddee\ud835\ude02\ud835\uddf1\ud835\uddf2 & \ud835\uddd6\ud835\uddfc\ud835\uddf1\ud835\uddf2\ud835\ude05 \ud835\uddd7\ud835\uddf2\ud835\uddf9\ud835\uddf6\ud835\ude03\ud835\uddf2\ud835\uddff \ud835\udddc\ud835\uddfb-\ud835\udde0\ud835\uddf2\ud835\uddfa\ud835\uddfc\ud835\uddff\ud835\ude06 \ud835\udde6\ud835\ude01\ud835\uddf2\ud835\uddee\ud835\uddf9\ud835\uddf2\ud835\uddff: \ud835\uddd6\ud835\uddf9\ud835\uddf6\ud835\uddf0\ud835\uddf8\ud835\uddd9\ud835\uddf6\ud835\ude05 \ud835\ude03\ud835\uddf6\ud835\uddee \ud835\uddda\ud835\uddfc\ud835\uddfc\ud835\uddf4\ud835\uddf9\ud835\uddf2 \ud835\udde6\ud835\uddf6\ud835\ude01\ud835\uddf2\ud835\ude00
\"\u26a0\" We\u2019re tracking a #ClickFix<\/a> campaign that mimics popular AI tools, including Codex and Claude, and abuses trusted Google Sites infrastructure\u2026 pic.twitter.com\/BeiU03Stua<\/a><\/p>\n

\u2014 ANY.RUN (@anyrun_app) June 3, 2026<\/a>\n<\/p><\/blockquote>\n