Cybercriminals Impersonate Claude Code to Deploy Fileless .NET Infostealer

Cybercriminals are actively exploiting the growing popularity of AI development tools by using SEO poisoning to target new users of Anthropic’s Claude Code.

Security researchers at Howler Cell have uncovered a sophisticated campaign that directs eager, non-technical builders to fake installation pages.

These spoofed pages use a social engineering technique known as ClickFix, which tricks users into pasting a malicious command into the Windows Run dialog (Win+R).

Because the victims are often first-time developers such as small business owners or teachers they lack a baseline for what a normal software installation should look like.

To them, pasting a command into a prompt seems like a legitimate setup step. With no enterprise security controls or proxy filtering in place, the attack triggers without hesitation, leading directly to stolen credentials and compromised identities.

Fake Claude Deploys Infostealer

The infection begins when the victim pastes the attacker-supplied command, which invokes mshta.exe to retrieve a payload from a fake software update domain (download.version-516[.]com).

To evade detection, the attackers use a clever 6.7 MB MP3/HTA polyglot file. This file functions as a genuinely playable audio track but contains a hidden HTML Application (HTA) script block.

Because security tools that check file headers only see a legitimate media file, they often prioritize analysis less, allowing mshta.exe to parse the file linearly and execute the malicious script.

Once executed, the HTA script creates a scheduled task that launches a 32-bit PowerShell process. Targeting a 32-bit process is a deliberate evasion tactic, as endpoint detection systems frequently focus their telemetry on 64-bit activity.

The PowerShell script then turns off security scanning by patching AMSI in memory, decrypts hidden strings using an RC4 key, and fingerprints the victim by hashing their computer name and username.

This unique hash is used to generate a custom, non-reusable URL for the next stage of the attack, effectively neutralizing traditional static IOC sharing among defenders.

According to Cyderes research, the loader connects to a specific subdomain on oakenfjrod[.]ru to download a massive 17 MB PowerShell script.

This bloated file size is not an accident; it is engineered to overwhelm sandbox environments, exhaust memory limits, and frustrate automated analysis tools.

The script executes entirely in memory and contains multiple layers of obfuscation, including a specific XOR layer using the key AMSI_RESULT_NOT_DETECTED.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.