InstallFix Campaign — Fake Claude AI Installer via Google Ads Drops mshta/ZIP-HTA Polyglot, AMSI-Bypass PowerShell & RedLine Stealer
InstallFix Campaign (TL-2026-0463), also tracked as InstallFix, is a high-severity malware campaign, first published 2026-05-05. It has no confirmed attribution, affects Microsoft Windows (mshta.exe, powershell.exe, cmd.exe, maps to 21 MITRE ATT&CK techniques (T1005, T1027, T1033), and is covered by 9 detection rules and 24 indicators of compromise.
Key facts for TL-2026-0463
- Threat ID
- TL-2026-0463
- Also known as
- InstallFix, Fake Claude Code Installer Campaign, ClickFix-Claude
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-05-05
- Last reviewed
- 2026-05-05
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- government, electronics, education, food-and-beverage
- Target regions
- Americas, AMEA, Europe, Malaysia, Netherlands, Thailand, United States
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in InstallFix Campaign
Malware and tooling: RedLine Stealer - S1240, Per-victim 16-hex subdomain pattern: <16hex>.oakenfjrod.ru/cloude-<guid>
Trend Micro disclosed the InstallFix campaign on May 5, 2026: Google Ads malvertising for searches such as 'Claude Code' redirects victims to fake Anthropic/Claude installer pages that present a ClickFix-style copy/paste PowerShell+mshta command. The chain pulls a ZIP/HTA polyglot (claude.msixbundle) from download-version[.]1-5-8[.]com, executes a hidden VBScript via Shell.Application COM, runs an obfuscated PowerShell stager that disables SSL validation, patches AMSI in-memory (RC4 key BWJFEesMEqRvjQbm; writes 0x41414141 into amsiContext), and IEX-loads a victim-unique stage 4 from oakenfjrod[.]ru. Persistence is established via scheduled tasks. Final-stage IOCs are associated with RedLine stealer (e-wallet and browser data theft), with confirmed targeting across government, electronics, education and food & beverage in the Americas, AMEA and Europe.
How InstallFix Campaign works
InstallFix is an active malvertising campaign disclosed by Trend Micro Research on May 5, 2026 that abuses the Anthropic/Claude AI brand to deliver a multi-stage Windows infection ending in a RedLine-associated stealer payload. The campaign begins with paid Google Ads keyed to high-intent searches such as 'Claude Code', 'Claude AI install' and similar queries; ad clicks redirect to convincing fake installer pages that mimic Anthropic's product surface and present an OS-specific 'install' command for the user to copy and execute — the canonical ClickFix social-engineering pattern repackaged for an AI brand.
The pasted Windows command invokes mshta.exe against https://download-version.1-5-8.com/claude.msixbundle. The payload at that URL is a polyglot file: the first 882,290 bytes form a valid ZIP archive (consistent with the .msixbundle extension), but an HTA document is appended at offset 882290 and is what mshta actually executes. Inside the HTA, a VBScript resizes the host window to 0x0 (window.resizeTo 0,0) for stealth, then uses the Shell.Application COM object (CLSID 9BA05972-F51F-4DE8-95A4-F561CC55EBC4) to spawn a child cmd.exe whose command line reconstructs the string 'powershell' through variable-splitting to defeat naive command-line detection. The reconstructed cmd.exe then launches the 32-bit SysWOW64 powershell.exe with -E and a UTF-16LE base64-encoded stager.
The stage-4 PowerShell stager performs four critical operations in-memory before executing the next stage: (1) it disables TLS certificate validation by assigning ServerCertificateValidationCallback to a delegate that always returns true; (2) it computes a per-victim fingerprint as the first 16 hex characters of MD5(COMPUTERNAME+USERNAME), which is then used as a unique subdomain under oakenfjrod.ru (e.g. https://<16hex>.oakenfjrod.ru/cloude-91267b64-989f-49b4-89b4-984e0154d4d1); (3) it patches AMSI in-process by locating amsiContext and overwriting an internal field via WriteInt32(0x41414141), corrupting the AMSI context so subsequent ScanBuffer calls fail open — RC4 key BWJFEesMEqRvjQbm and XOR key AMSI_RESULT_NOT_DETECTED are observed in the bypass routine; and (4) it fetches the victim-unique stage 5, base64-decodes it, and executes it via IEX entirely in memory (no disk artifact for the final payload).
Stage 5 IOCs (sha256 2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74; sha1 811fbf0ff6b6acabe4b545e493ec0dd0178a0302) are associated with RedLine Stealer behavior. Observed post-compromise activity includes credential and cookie collection from major web browsers, cryptocurrency wallet exfiltration (the 'e-wallet' modules characteristic of RedLine), and scheduled-task persistence registered via schtasks.exe. Outbound C2 reuses the per-victim subdomain over HTTPS.
Attribution is mixed and not high-confidence: the Trend Micro write-up describes the operation in 'state-linked espionage' terms while noting that the final-stage TTPs — particularly the AMSI patch pattern, the variable-splitting cmd.exe loader and the ClickFix delivery — closely mirror RedLine Stealer campaigns from 2023, suggesting either a financially motivated operator reusing well-trodden stealer infrastructure or a state-aligned actor masquerading as commodity crimeware. Confirmed victim telemetry from Trend Micro Vision One MDR spans Americas, AMEA and Europe, with named exposure in Malaysia, the Netherlands, Thailand and the United States across government, electronics, education and food & beverage verticals.
Defensive priorities: block the four campaign domains (download-version.1-5-8.com, oakenfjrod.ru, yeezyhost.net, get-version.com) and the three campaign IPs at perimeter; alert on mshta.exe fetching .msixbundle URLs; alert on mshta.exe spawning cmd.exe and on cmd.exe spawning SysWOW64 powershell.exe; alert on PowerShell command lines containing -E with long UTF-16LE base64 payloads; alert on in-process WriteInt32 patches against amsiContext; hunt for scheduled tasks created shortly after PowerShell execution; and validate browser credential and crypto wallet store access. The campaign is treated as ACTIVE pending takedown of the malvertising chain.
MITRE ATT&CK techniques used in TL-2026-0463
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1218.005 System Binary Proxy Execution: Mshta; T1564.003 Hide Artifacts: Hidden Window
Discovery
T1033 System Owner/User Discovery; T1082 System Information Discovery
Exfiltration
T1041 Exfiltration Over C2 Channel
Persistence
T1053.005 Scheduled Task/Job: Scheduled Task
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.005 Command and Scripting Interpreter: Visual Basic; T1204.001 User Execution: Malicious Link; T1204.002 User Execution: Malicious File; T1559.001 Inter-Process Communication: Component Object Model
Command and Control
T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer; T1573.002 Encrypted Channel: Asymmetric Cryptography
Credential Access
T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Initial Access
T1566.002 Phishing: Spearphishing Link
Resource Development
T1583.008 Acquire Infrastructure: Malvertising
defense-impairment
Affected products and versions in InstallFix Campaign
- Microsoft — Windows (mshta.exe, powershell.exe, cmd.exe, Shell.Application COM)
Vulnerable versions: Windows 10; Windows 11 - Anthropic — Claude / Claude Code (brand impersonation only — no Anthropic product flaw)
Remediation for InstallFix Campaign
Immediate actions
- Block domains download-version.1-5-8.com, oakenfjrod.ru, yeezyhost.net and get-version.com at DNS, proxy and firewall layers
- Block IPs 104.21.0.95, 185.177.239.255 and 77.91.97.244 at perimeter
- Alert on mshta.exe fetching remote .msixbundle URLs (rare/anomalous combination)
- Alert on mshta.exe spawning cmd.exe and cmd.exe spawning C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- Alert on PowerShell command lines containing -E or -EncodedCommand with long UTF-16LE base64 payloads
- Quarantine and forensically image any host that executed claude.msixbundle or mshta against download-version.1-5-8.com
- Reset credentials and rotate session tokens for any account that touched a compromised host (browser-stored credentials must be assumed exfiltrated)
Workarounds
- Disable mshta.exe execution on user endpoints (WDAC/AppLocker rule)
- Disable Windows Script Host (WScript/CScript) where not required
- Block .hta and .msixbundle downloads at web proxy
- Apply ASR rule 'Block all Office applications from creating child processes' and equivalent rules limiting LOLBin abuse
Longer-term hardening
- Deploy EDR with in-process AMSI tamper detection (alert on writes to AMSI_RESULT/amsiContext memory regions)
- Block PowerShell -E execution policy via AppLocker or WDAC where business-justified
- Disable mshta.exe via WDAC for general-purpose user endpoints; restrict to admin tier
- Enable PowerShell Script Block Logging (Event ID 4104) and Module Logging across the estate
- Train users on ClickFix-style social engineering: legitimate vendors never ask end users to paste install commands into Run/Win+R or PowerShell
- Subscribe to brand-protection / malvertising takedown service for high-value AI/SaaS brand impersonation
- Implement DNS resolution allowlists for SaaS domains in high-risk segments
Timeline of InstallFix Campaign
- RedLine Stealer first identified for sale as malware-as-a-service on Russian-language cybercrime forums; becomes a dominant commodity infostealer over subsequent years
- Trend Micro and other vendors document AMSI in-memory patching, ClickFix-style malvertising, and variable-splitting cmd.exe loaders as common TTPs in 2023 RedLine Stealer campaigns — the InstallFix tradecraft mirrors this lineage
- Threadlinqs Intelligence published TL-2026-0463 with full D1 record, MITRE mappings, IOCs, and detection coverage
- Campaign IOCs published: domains download-version.1-5-8.com, oakenfjrod.ru, yeezyhost.net, get-version.com; IPs 104.21.0.95, 185.177.239.255, 77.91.97.244; payload SHA256 2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74
- Trend Micro Vision One MDR confirmed live customer incident with victims across Americas, AMEA and Europe (Malaysia, Netherlands, Thailand, United States) in government, electronics, education, and food & beverage verticals
- Trend Micro Research published 'InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise' detailing the full mshta/ZIP-HTA polyglot, AMSI-bypass PowerShell, and RedLine-associated stage 5 chain
- As of 2026-05-29, the InstallFix fake-Claude-Code malvertising/ClickFix campaign remains ACTIVE and evolving: Trend Micro (May 5), Microsoft, Bitdefender, Malwarebytes and Push Security report continuous Google-Ads abuse, rapidly rotated C2 domains, and expansion to other dev-tool lures. No takedown reported; the social-engineering + LOLBin chain has no patch, and RedLine-style stage 5 persists via repackaged builds.
Sources cited for InstallFix Campaign
- InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
- MITRE ATT&CK T1218.005 — System Binary Proxy Execution: Mshta
- MITRE ATT&CK T1583.008 — Acquire Infrastructure: Malvertising
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
- MITRE ATT&CK T1559.001 — Inter-Process Communication: Component Object Model
- MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell
- MITRE ATT&CK Software S0593 — RedLine Stealer
- MITRE ATT&CK T1027 — Obfuscated Files or Information
Threats related to InstallFix Campaign
Detection coverage for TL-2026-0463
As of 2026-05-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0463 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.