Loading...
Loading...
The Race for AI Just Became a Trap
Right now, there is an unspoken pressure across the tech industry: integrate AI into your workflow, or get left behind. Developers, startup founders, and educators are scrambling to test the latest tools to code faster and work smarter. Threat actors are acutely aware of this gold rush. They know that when people are in a hurry to adopt new technology, they take shortcuts. They bypass standard procurement processes. They click first and ask questions later.
Hackers aren't wasting their time trying to brute-force enterprise firewalls anymore. Instead, they are quietly setting up shop at the front door, preying on those eager to test out Anthropic’s new Claude Code assistant.
According to a sobering new threat intelligence report from security firm Cyderes, a highly sophisticated, fileless credential-theft campaign is actively hunting these first-time users. The attackers are weaponizing the very hype surrounding AI, using a devastatingly clever chain of social engineering and memory-resident malware. By the time a victim realizes the AI coding assistant isn't actually installing, their browser passwords, session cookies, and digital identity are already sitting on a command-and-control server routed through Russia.
The ClickFix: Weaponizing Muscle Memory
This attack chain doesn't kick off with an ultra-rare zero-day exploit. It starts with a much older, highly effective tactic: SEO poisoning. When an eager developer types "how to install Claude Code" into their search engine, manipulated algorithms funnel them directly to a spoofed, highly convincing Anthropic landing page.
Here is where the attackers get intimately psychological. To bypass the automated security sandboxes that usually catch malicious downloads, they deploy a classic "ClickFix" lure. The fake site throws up a fabricated error or installation prompt, instructing the user to manually open the Windows Run dialog box (Win+R) and paste a specific command to "fix" the issue and install the tool.
That command leverages mshta.exe—a legitimate, built-in Windows utility historically used to execute HTML applications. By convincing the user to run this command themselves, the attackers are relying on social engineering to establish hands-on-keyboard execution. They trick the victim into pulling the trigger, turning the user into the initial access vector. It is a textbook "Living off the Land" (LotL) technique, using the operating system's own trusted tools against it.
The Smuggler's Suitcase: Unpacking the Polyglot Payload
Once that mshta.exe command runs, the system reaches out to a malicious domain (download.version-516[.]com/claude) and pulls down a 6.7 MB file. This is where the technical sophistication really ramps up.
The downloaded file is an MP3/HTA "polyglot" payload. Think of a polyglot file like a smuggler's suitcase with a false bottom. To a casual file-type inspection tool, a basic antivirus, or even the VLC media player, this file looks and acts like a harmless audio track. It contains entirely valid audio tags, cover art, and playable sound.
But hidden beneath the music is an embedded HTA (HTML Application) script block. Because the victim executed mshta.exe, that specific Windows process ignores the audio data completely, zeros in on the hidden script, and kicks off the real nightmare.
Blinding the Guards and Bloating the Memory
Once inside, the malware exhibits a masterclass in evasion. Instead of running a standard command shell, the script spawns a hidden, older 32-bit version of Windows PowerShell. This is a deliberate, highly calculated move. Most modern Endpoint Detection and Response (EDR) platforms are hyper-focused on monitoring the 64-bit version of PowerShell, which is the standard on modern machines. By forcing a downgrade to the 32-bit version, the attackers slip right into a massive blind spot.
From the shadows of that unmonitored process, the loader executes an AMSI bypass. The Anti-Malware Scan Interface (AMSI) is the built-in Windows guard dog that scans scripts for malicious behavior before they run. By disabling it, the attackers effectively turn off the alarm system. The script then uses a hardcoded secret key (BWJFEesMEqRvjQbm) to decrypt its payload, scrambling the victim's computer name and username into a unique identifier.
The final stage of the loader reaches out to a new domain (oakenfjrod[.]ru) to download a massive 17 MB script. This isn't sloppy, bloated coding; it is an intentional, aggressive tactic. Automated security sandboxes are designed to analyze files quickly. By forcing the system to process a massive 17 MB script, the attackers overwhelm the sandbox, often causing it to time out or crash before it can determine if the file is malicious.
Crucially, this entire process occurs directly inside the computer's temporary RAM. No malicious executable is ever saved to the hard drive. It is a completely fileless attack, leaving almost no forensic footprint for traditional antivirus sweeps to find.
The Impact: Silent Extraction and Session Hijacking
Embedded deep inside that bloated Stage 3 script is a reflective .NET infostealer. By abusing the .NET Framework's Assembly.Load(byte[]) feature, the malware executes its code directly within the existing PowerShell memory space.
Then, the silent extraction begins.
The infostealer ruthlessly targets the victim’s browser credential store. It scrapes saved passwords, autofill data, and financial information. But most dangerously, it steals session cookies.
For a threat actor, a session cookie is the holy grail. If an attacker steals your username and password, they still have to get past your Multi-Factor Authentication (MFA) prompt. But if they steal your active session cookie, they can import it into their own browser and effectively clone your active login. They become you. MFA is completely bypassed because the system believes you have already authenticated.
The malware immediately fires this stolen data off to a command-and-control server (185.177.239.255:443). Cyderes researchers noted that this IP address routes directly to Russian infrastructure, meaning the stolen credentials will likely be bundled and sold on underground initial access markets before the victim even finishes their coffee.
Actionable Takeaways
To be absolutely clear: Anthropic’s actual infrastructure has not been compromised. This campaign is a targeted exploitation of human excitement and software adoption. Defending against a fileless, socially engineered attack requires a fundamental shift in both network monitoring and user behavior.
· For Defenders and Threat Hunters: Standard EDR rules are not enough here. Security teams must adjust their behavioral heuristics to monitor all instances of PowerShell, specifically alerting on 32-bit versions spawned from unexpected parent processes like mshta.exe. Cyderes strongly advises blackholing wildcard queries to *.oakenfjrod[.]ru and aggressively scrutinizing any outbound network connections originating from mshta.
· For CISOs: Review your organization's acceptable use policies regarding shadow IT and the adoption of new AI tools. If developers feel they have to bypass security to get the tools they need to do their jobs, they will find a way—and threat actors will be waiting for them.
· For Everyday Users: Security awareness remains your ultimate firewall. Legitimate software vendors will never ask you to install a product by copying and pasting a random command into the Windows Run dialog box. If a website asks you to hit "Win+R" to fix an installation error, close the tab immediately. Your network—and your digital identity—depends on it.
References
· Ahmed, D. (2026, May 30). Fake Anthropic Sites Deliver Fileless Infostealer to Claude Code Users. Hackread. https://hackread.com/fake-anthropic-sites-fileless-infostealer-claude-code-users/
· Cyderes. (2026, May 28). Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer. Cyderes Howler Cell. https://www.cyderes.com/howler-cell/fake-claude-code-installer-infostealer