# InstallFix Campaign — Fake Claude AI Installer via Google Ads Drops mshta/ZIP-HTA Polyglot, AMSI-Bypass PowerShell & RedLine Stealer

> Trend Micro disclosed the InstallFix campaign on May 5, 2026: Google Ads malvertising for searches such as 'Claude Code' redirects victims to fake Anthropic/Claude installer pages that present a ClickFix-style copy/paste PowerShell+mshta command. The chain pulls a ZIP/HTA polyglot (claude.msixbundle) from download-version[.]1-5-8[.]com, executes a hidden VBScript via Shell.Application COM, runs an obfuscated PowerShell stager that disables SSL validation, patches AMSI in-memory (RC4 key BWJFEesMEqRvjQbm; writes 0x41414141 into amsiContext), and IEX-loads a victim-unique stage 4 from oakenfjrod[.]ru. Persistence is established via scheduled tasks. Final-stage IOCs are associated with RedLine stealer (e-wallet and browser data theft), with confirmed targeting across government, electronics, education and food & beverage in the Americas, AMEA and Europe.

- **Published:** 2026-05-05T12:00:00Z
- **Last reviewed:** 2026-05-05T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0463
- **ID:** TL-2026-0463
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

InstallFix is an active malvertising campaign disclosed by Trend Micro Research on May 5, 2026 that abuses the Anthropic/Claude AI brand to deliver a multi-stage Windows infection ending in a RedLine-associated stealer payload. The campaign begins with paid Google Ads keyed to high-intent searches such as 'Claude Code', 'Claude AI install' and similar queries; ad clicks redirect to convincing fake installer pages that mimic Anthropic's product surface and present an OS-specific 'install' command for the user to copy and execute — the canonical ClickFix social-engineering pattern repackaged for an AI brand.

The pasted Windows command invokes mshta.exe against https://download-version.1-5-8.com/claude.msixbundle. The payload at that URL is a polyglot file: the first 882,290 bytes form a valid ZIP archive (consistent with the .msixbundle extension), but an HTA document is appended at offset 882290 and is what mshta actually executes. Inside the HTA, a VBScript resizes the host window to 0x0 (window.resizeTo 0,0) for stealth, then uses the Shell.Application COM object (CLSID 9BA05972-F51F-4DE8-95A4-F561CC55EBC4) to spawn a child cmd.exe whose command line reconstructs the string 'powershell' through variable-splitting to defeat naive command-line detection. The reconstructed cmd.exe then launches the 32-bit SysWOW64 powershell.exe with -E and a UTF-16LE base64-encoded stager.

The stage-4 PowerShell stager performs four critical operations in-memory before executing the next stage: (1) it disables TLS certificate validation by assigning ServerCertificateValidationCallback to a delegate that always returns true; (2) it computes a per-victim fingerprint as the first 16 hex characters of MD5(COMPUTERNAME+USERNAME), which is then used as a unique subdomain under oakenfjrod.ru (e.g. https://<16hex>.oakenfjrod.ru/cloude-91267b64-989f-49b4-89b4-984e0154d4d1); (3) it patches AMSI in-process by locating amsiContext and overwriting an internal field via WriteInt32(0x41414141), corrupting the AMSI context so subsequent ScanBuffer calls fail open — RC4 key BWJFEesMEqRvjQbm and XOR key AMSI_RESULT_NOT_DETECTED are observed in the bypass routine; and (4) it fetches the victim-unique stage 5, base64-decodes it, and executes it via IEX entirely in memory (no disk artifact for the final payload).

Stage 5 IOCs (sha256 2f04ba77bb841111036b979fc0dab7fcbae99749718ae1dd6fd348d4495b5f74; sha1 811fbf0ff6b6acabe4b545e493ec0dd0178a0302) are associated with RedLine Stealer behavior. Observed post-compromise activity includes credential and cookie collection from major web browsers, cryptocurrency wallet exfiltration (the 'e-wallet' modules characteristic of RedLine), and scheduled-task persistence registered via schtasks.exe. Outbound C2 reuses the per-victim subdomain over HTTPS.

Attribution is mixed and not high-confidence: the Trend Micro write-up describes the operation in 'state-linked espionage' terms while noting that the final-stage TTPs — particularly the AMSI patch pattern, the variable-splitting cmd.exe loader and the ClickFix delivery — closely mirror RedLine Stealer campaigns from 2023, suggesting either a financially motivated operator reusing well-trodden stealer infrastructure or a state-aligned actor masquerading as commodity crimeware. Confirmed victim telemetry from Trend Micro Vision One MDR spans Americas, AMEA and Europe, with named exposure in Malaysia, the Netherlands, Thailand and the United States across government, electronics, education and food & beverage verticals.

Defensive priorities: block the four campaign domains (download-version.1-5-8.com, oakenfjrod.ru, yeezyhost.net, get-version.com) and the three campaign IPs at perimeter; alert on mshta.exe fetching .msixbundle URLs; alert on mshta.exe spawning cmd.exe and on cmd.exe spawning SysWOW64 powershell.exe; alert on PowerShell command lines containing -E with long UTF-16LE base64 payloads; alert on in-process WriteInt32 patches against amsiContext; hunt for scheduled tasks created shortly after PowerShell execution; and validate browser credential and crypto wallet store access. The campaign is treated as ACTIVE pending takedown of the malvertising chain.

## MITRE ATT&CK

- T1583.008 Acquire Infrastructure: Malvertising
- T1566.002 Phishing: Spearphishing Link
- T1204.001 User Execution: Malicious Link
- T1204.002 User Execution: Malicious File
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1559.001 Inter-Process Communication: Component Object Model
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1218.005 System Binary Proxy Execution: Mshta
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1564.003 Hide Artifacts: Hidden Window
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1041 Exfiltration Over C2 Channel

## Sources

- [InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise](https://www.trendmicro.com/en_us/research/26/e/installfix-and-claude-code.html)
- [MITRE ATT&CK T1218.005 — System Binary Proxy Execution: Mshta](https://attack.mitre.org/techniques/T1218/005/)
- [MITRE ATT&CK T1583.008 — Acquire Infrastructure: Malvertising](https://attack.mitre.org/techniques/T1583/008/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [MITRE ATT&CK T1559.001 — Inter-Process Communication: Component Object Model](https://attack.mitre.org/techniques/T1559/001/)
- [MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK Software S0593 — RedLine Stealer](https://attack.mitre.org/software/S0593/)
- [MITRE ATT&CK T1027 — Obfuscated Files or Information](https://attack.mitre.org/techniques/T1027/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0463