Cybercriminals have devised a method to target developers and IT professionals by creating counterfeit download pages masquerading as Claude Code, a recognized AI coding assistant. These fraudulent pages deceive users into downloading what is purported to be an authentic installation package, but instead, they inadvertently install infostealer malware onto their systems.
AI Tools as a New Target
This tactic of leveraging a well-known AI tool highlights an emerging trend where malicious actors exploit the growing popularity of artificial intelligence platforms to gain user trust and avoid suspicion. The initial discovery of this attack occurred through a distribution campaign utilizing it..com as the delivery domain. Victims are drawn to these sites, which are meticulously designed to resemble legitimate software download portals.
Once users click the download button, rather than receiving genuine software, they trigger a harmful execution chain that commences as soon as the file is opened. The realistic design of these fraudulent pages leaves users with little reason to doubt the file’s authenticity until it is too late.
Technical Insights and Expert Commentary
Cybersecurity analyst Maurice Fielenbach noted the campaign, emphasizing that the attack culminates in a straightforward MSHTA-based infostealer. He mentioned that mshta.exe, a legitimate Microsoft Windows binary, is crucial for defenders to monitor as it is often exploited by attackers to execute malicious HTML Application (HTA) files fetched from remote sources. Fielenbach also emphasized that tracking HTA execution from remote locations is a significant indicator of actual attacker activity.
This campaign falls within a documented pattern where threat actors capitalize on the trust people place in AI tools. As AI-assisted coding platforms become more widely adopted, criminals identify a larger pool of potential victims who may be less cautious when downloading seemingly legitimate productivity tools. This is not the first instance of using Claude-themed lures; previous campaigns have similarly exploited AI branding, indicating this trend is not isolated.
Impact and Mitigation Strategies
The repercussions of this infostealer for affected users can be severe. Once the malware is executed on a victim’s machine, it can harvest browser-stored credentials, session tokens, and other sensitive information before transmitting it to attacker-controlled servers. For developers, who are the primary targets, the consequences extend beyond personal data loss. Compromised credentials may provide access to code repositories, cloud environments, and internal systems, potentially leading to broader organizational security breaches.
The infection mechanism in this campaign centers on exploiting mshta.exe, a signed Microsoft binary integral to the Windows operating system. Because it is a trusted system tool, many security products do not flag its activity by default, providing a low-profile vehicle for attackers. This technique, known as Living off the Land, is cataloged under MITRE ATT&CK as T1218.005, enabling malware execution without deploying a traditional executable file to the disk, thereby reducing its detection footprint significantly.
When victims interact with the counterfeit download page, mshta.exe is activated to fetch and run a remote HTA file with an embedded malicious script. This script performs the infostealer’s primary functions, such as collecting credentials and browser data, entirely within memory. The use of remote HTA execution means the payload never physically lands on the system as a standalone file, complicating forensic recovery for incident responders post-attack.
Security teams are strongly advised to enable detailed logging for mshta.exe activity across all endpoints and flag any instance where it connects to external URLs. Organizations should consider restricting mshta.exe execution through application control policies where operational requirements permit. Users are encouraged to verify software downloads from official vendor sources and avoid downloading tools from third-party or unfamiliar websites, regardless of how genuine the page may appear.
