Fake Claude Code Installer Steals Developer Credentials: The ClickFix Campaign Every CISO Must Know + Video

Introduction:

A sophisticated social engineering campaign is actively exploiting the growing popularity of AI developer tools by hosting fake installation guides on Google Sites. Victims are tricked into running a single `mshta` command, which initiates an in-memory attack chain that uses steganography—hiding malicious payloads within image files—to silently exfiltrate credentials, email data, and cryptocurrency wallet information without ever writing a file to disk.

Learning Objectives:

– Understand the technical anatomy of the ClickFix attack chain from initial lure to in-memory payload execution.
– Identify key Indicators of Compromise (IoCs) and implement detection rules for malicious `mshta.exe` and PowerShell activity.
– Learn practical hardening commands to restrict PowerShell, monitor process creation, and block malicious domains on Linux and Windows.

You Should Know:

1. How the ClickFix Attack Chain Executes Completely in Memory

This attack begins with a fake installer page hosted on Google Sites. The victim is instructed to open the Run dialog (Win+R) and execute an `mshta` command that points to a malicious script. Because the page is on a legitimate Google domain, many users trust the instructions without verifying them through official sources like `claude.ai` or `code.anthropic.com`.

Once executed, `mshta.exe` spawns a hidden PowerShell process that downloads a benign-looking image file. The actual malware is hidden within the image’s pixel data using steganography. The PowerShell script extracts this payload at runtime and injects the shellcode directly into a running PowerShell process. Since no executable file is ever written to disk, traditional antivirus tools that rely on file signatures fail to detect the attack.

 Simulated detection: Monitor for suspicious mshta parent-child relationships
 Windows Command (PowerShell as Admin):
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4688} | Where-Object { $_.Properties[bash].Value -like 'mshta.exe' -and $_.Properties[bash].Value -like 'powershell.exe' }

 Linux command to monitor for suspicious curl/wget executions (simulate detection):
sudo auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/curl -k process

To verify the legitimacy of any installation instruction, always cross-reference with the official GitHub repository or vendor documentation. Organizations should deploy endpoint detection tools capable of behavioral analysis, which can identify suspicious PowerShell activity even when no file is written to disk.

2. Critical IoCs and Detection Rules for SOC Teams

The following indicators are taken directly from the ANY.RUN sandbox analysis sessions referenced in the source:

| Type | Indicator | Description |

||–|-|

Implement these detection rules in your SIEM:

 Sigma rule example for suspicious mshta execution (Windows Event ID 4688)
 Detection logic: mshta.exe with command line containing script references
 and spawning PowerShell or cmd.exe as child process

 PowerShell command to query suspicious process ancestry:
Get-WmiObject Win32_Process | Where-Object { $_.ParentProcessId -eq (Get-Process -1ame mshta).Id }

 Linux (Sysmon-like alternative via osquery):
SELECT  FROM processes WHERE parent = "mshta.exe" AND (name = "powershell.exe" OR name = "cmd.exe");

Note that all IP addresses and domains in the table above are intentionally defanged with `[.]` to prevent accidental resolution. Re-fang these indicators only within controlled threat intelligence platforms such as MISP, VirusTotal, or your corporate SIEM.

3. Hardening Endpoints Against In-Memory PowerShell Attacks

Since the attack chain relies on PowerShell executing in-memory code, restricting PowerShell to Constrained Language Mode (CLM) can significantly reduce the attack surface. CLM allows only basic scripts and cmdlets while prohibiting dynamic code generation and unsafe operations.

 Enable Constrained Language Mode via Group Policy (Windows):
 Navigate to: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell
 Set "Turn on PowerShell ConstrainedLanguage mode" to Enabled

 Alternatively, set via PowerShell command (requires admin):
$ExecutionContext.SessionState.LanguageMode
 To set ConstrainedLanguage mode, use:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell" -1ame "EnableConstrictedLanguage" -Value 1

 Enable PowerShell logging for deeper visibility:
 Log all PowerShell script blocks:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -1ame "EnableScriptBlockLogging" -Value 1

 Log PowerShell module loading:
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ModuleLogging" -1ame "EnableModuleLogging" -Value 1

For Linux-based developer environments that may interact with Windows VMs or WSL, monitor for suspicious PowerShell Core (`pwsh`) execution:

 Linux: Monitor for pwsh process creation
auditctl -a always,exit -F arch=b64 -S execve -F path=/usr/bin/pwsh -k powershell_exec

 Check for encoded commands in shell history
grep -i "encod" ~/.bash_history ~/.zsh_history | grep -i powershell

4. Using ANY.RUN for Interactive Malware Analysis

The ANY.RUN sandbox platform is a critical tool for analyzing ClickFix campaigns in real time. Security professionals can upload suspicious URLs or files to observe the full attack chain in an isolated Windows environment. The sandbox provides process trees, network traffic logs, and extracted IoCs.

 Workflow for analyzing a suspicious link:
1. Navigate to app.any.run
2. Create a new task with Windows 10/11 VM
3. Enter the suspicious Google Sites URL under "Object to run"
4. Enable "Full network simulation" to capture C2 traffic
5. Click "Run" and observe the process tree for mshta.exe -> powershell.exe
6. Extract image files from the VM to scan for steganographic payloads

 Manual image steganography detection (using steghide on Linux):
steghide --extract -sf suspicious_image.png

 Check for appended data in image files:
strings suspicious_image.png | tail -20

This campaign also highlights the importance of using steganography-aware detection tools. While attackers hide shellcode inside image pixels, advanced memory scanners can detect the payload after it is extracted by PowerShell.

5. Mitigating AI Tool-Based Supply Chain Attacks

Beyond the ClickFix campaign, attackers are increasingly targeting AI development workflows through compromised npm packages and VSCode extensions. A 2025 supply chain attack known as “Shai-Hulud” used weaponized AI assistants to scan victim systems for credentials and SSH keys. Similarly, typosquatting attacks have been observed publishing malicious packages impersonating Claude Code and other popular AI tools.

 Windows: Verify npm package signatures before installation
npm audit --production
npm install --ignore-scripts  Prevent postinstall hooks

 Linux: Use sandboxed npm installation via Docker
docker run -it --rm -v "$PWD":/app -w /app node:18-alpine npm install --production

 Check for suspicious PowerShell execution in postinstall scripts:
find . -1ame ".ps1" -exec grep -l "Invoke-Expression\|iex\|Start-Process" {} \;

Organizations should implement controls that restrict PowerShell and mshta execution to only authorized processes. Attack Surface Reduction (ASR) rules in Microsoft Defender can block these attack vectors.

 Windows Defender ASR rule to block mshta child processes (PowerShell as Admin):
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled

 Block all Office applications from creating child processes:
Add-MpPreference -AttackSurfaceReductionRules_Ids "D4F940AB-401B-4EFC-AADC-AD5F3C50688A" -AttackSurfaceReductionRules_Actions Enabled

What Undercode Say:

– The attack chain’s move toward in-memory execution and steganography demonstrates how file-based detection alone is insufficient for modern threats. Security teams must prioritize behavioral analysis tools that detect suspicious process ancestry, such as mshta.exe spawning PowerShell.exe, regardless of whether a file is written to disk.
– The abuse of Google Sites as a trusted hosting platform for malware distribution is a strategic evolution in social engineering. By leveraging legitimate domains, attackers bypass many traditional URL filters. Organizations should deploy browser isolation or URL rewriting solutions that re-evaluate links even from trusted domains, while also training developers to verify installation instructions through official GitHub repositories or vendor documentation.
– The convergence of AI tool adoption and credential-stealing malware suggests that developers are now a primary target for supply chain attacks. A compromised developer machine with access to production systems, API keys, and cloud consoles represents a high-value breach. Security awareness programs must expand to include “social engineering 2.0”—where technical users are tricked by platforms they trust.
– The ANY.RUN analysis sessions provide actionable IoCs, but the speed of campaign evolution means defenders must automate threat hunting. SIEM rules that detect mshta-to-PowerShell parent-child relationships and outbound PowerShell network traffic to unusual ports should be prioritized. A single false positive is far cheaper than an undetected credential exfiltration.
– While Linux environments are less directly affected by this Windows-specific attack, the fundamental technique of hiding malicious payloads in trusted platforms applies universally. Linux security teams should extend monitoring to detect curl or wget executions from scripts and any subsequent execution of encoded or base64 commands, which are common indicators of in-memory attacks.

Prediction:

– +1 The ClickFix technique will evolve into automated phishing-as-a-service platforms, lowering the barrier for entry for less technical attackers and dramatically increasing the volume of credential-stealing campaigns.
– +1 In response, cloud EDR vendors will release dedicated ClickFix detection rules that specifically analyze process ancestry for mshta.exe and isolate the parent Google Sites domain before payload execution.
– -1 Organizations without behavioral EDR or AMSI-enabled PowerShell logging will experience a surge in successful breaches, as traditional antivirus and URL filters cannot detect the in-memory attack chain.
– -1 The use of trusted platforms like Google Sites will force security teams to adopt zero-trust for web content, possibly leading to friction in developer workflows as browser isolation or URL sandboxing tools are enforced.

▶️ Related Video (80% Match):

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

[Join Undercode Academy for Verified Certifications](https://undercode.co.uk/certifications/)

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[[email protected]](mailto:[email protected])
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: [Tushar Subhra](https://www.linkedin.com/posts/tushar-subhra-dutta_cybersecuritynews-csn-share-7468205220880093185-Rwk8/) – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

[💬 Whatsapp](https://undercode.help/whatsapp) | [💬 Telegram](https://t.me/UndercodeCommunity)

📢 Follow UndercodeTesting & Stay Tuned:

[𝕏 formerly Twitter 🐦](https://x.com/undercodeupdate) | [@ Threads](https://www.threads.net/@undercodetesting) | [🔗 Linkedin](https://www.linkedin.com/company/undercodetesting/) | [🦋BlueSky](https://bsky.app/profile/undercode.bsky.social)

Listen to this Post