CyberWire Daily - A little help from your search engine. [Research Saturday]

Episode Date: August 8, 2026

Today we are joined by Brian Hussey, SVP of Howler Cell Threat Services at Cyderes, discussing their work on "Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer." Howler Cell identified an SEO poisoning campaign targeting people searching for Claude Code installation guides, using a fake Anthropic page and a ClickFix lure to trick victims into running a malicious MSHTA command. The attack uses a six-stage, largely fileless chain that employs an MP3/HTA polyglot, PowerShell obfuscation, AMSI bypasses, per-victim infrastructure, and in-memory execution to evade detection. The final payload is a .NET infostealer that steals credentials, while Anthropic and the legitimate Claude Code installation process were not compromised. The research and executive brief can be found here: Bad Ads, Worse Binaries: Fake Claude Code Installer Drops Infostealer

You're listening to the Cyberwire Network, powered by N2K. AI is making fishing attacks faster, more convincing, and harder for people to spot, and traditional security awareness and fishing training weren't designed for this level of attack. Hawkshunt helped security teams prepare employees for the attacks they face every day, with personalized fishing training that adapts to each employee and reduces risky behavior over time. For IT and security leaders looking to strengthen their human layer of defense, without adding more manual work, visit hoxhunt.com slash cyberwire to learn more. That's h-o-x-h-U-N-T.com slash cyberwire. Hello, everyone, and welcome to the Cyberwires Research Saturday.

I'm Dave Bittner, and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the, the hard problems and protecting ourselves in our rapidly evolving cyberspace. Thanks for joining us. We were able to identify a really sophisticated attack, malware campaign, and that evaded the client's entire security stack. But we found it really, really interesting because of some of the creative techniques that used, some of the ways it bypassed security mechanisms, and was able to really expand its victim footprint. So we decided to dig deep, do the analysis, and publish on it.

That's Brian Hussie, senior vice president of Howler Sell Threat Services at Saideris. The research we're discussing today is titled Bad Ads, Worst Bineries, Fake Clawed Code, installer drops info stealer. Well, the research is a really effective story here. The storytelling itself is noteworthy. And you all begin the report with a first-time developer who's trying to install cloud code. Why was it important

to frame the story around that person? Well, that's just it. One of the things I think that made the story really interesting was its effectiveness of how it used SEO. I think any advertising firm would be very proud of the fact that this was able to get on front page

for Google and other search engines. And really what that means is, it took advantage of AI, which is the rage right now. You've got all of these people that I realized suddenly, hey, I can go build things. I'm not a coder, but I can go make an app. I can go do things and create things that was never possible before and use AI in a way to make them more effective. That's what we're all doing. So you've got this legion of people that are looking up anthropic, looking up Claude,

looking up chat, GPT, anything like that. and when the first page and the first, you know, in some cases the first link is to download a site that mimics anthropic. You know, it's been important to say anthropic is not compromised. This was a fake install site, but it mimicked Anthropic very, very well. So you've got all of these people that are launching towards AI wanting to build something I've never built before and are met with this page. And they don't know. They may not have the threat background that a lot of folks do. They may not have all the security mechanisms that some of the corporates do.

So we feel like the victim footprint is really, really large, shaking advantage of the AI world that we're in today. And so that's part of the reason we wanted to kind of frame it like that. Say, could be a teacher, could be a small business person. And they're trying to leverage AI to improve their business or do something they haven't done before. and they're being taken advantage of. Well, let's walk through it together. You know, let's imagine that I'm one of those folks you described who's curious about this,

what all the hype is around AI and ClaudeCode in particular. So I do a Google search or any of the search engines for ClaudeCode Install. What happens next? Well, so right up at the top of your page, you've got the link that looks correct. You click on it. And from there, the whole attack chain starts,

to run. After you click on that link, you get the legitimate looking site. You go to the download. And there's an original Click Fix Lure, which is really, really popular. In fact, I think you've been on your show a few weeks ago. You had a deep dive into that. So they trick the user into pasting something into the Windows Run Dialogue, command line that launches the MSHTA.

From there, I think the attack gets really interesting because it downloads. this polyglop file. What polyglop means is it can be two things, two legitimate things at once. So this polygap file is an MP3. It is a music file. It's legitimate. It plays music. It looks legitimate to the user. And more importantly, it looks legitimate to the Windows operating system. So this is, even though it has that malicious script embedded in it. So that malicious script runs, that launches directly into a new power show loader, and that disables AMC. So AMC is the Microsoft anti-malware capability.

And from this point on, this runs completely in memory. It is a nothing touches a hard drive. It's all encrypted. There's a very good job of hiding from traditional defenses. But again, it bypasses the Windows AMC, the anti-mower capability. and then it creates, it accesses everything on the computer,

creates an interesting, and I thought this was interesting as well, because it really, it disables the ability to use traditional for intelligence, atomic IOCs, like hashes, domains, IPs, because it reaches out to a unique URL based on the computer's host name

and the username, runs a very large script, 17 megabytes. It's a massive script. Yeah, let me interrupt you there because, as you say, that is big. Why would attackers intentionally make such a large file? It would strike me that that would draw attention to itself. Well, in fact, just the opposite.

Well, it didn't in fact draw attention from any of the anti-mower capabilities, but what it did, it made it very challenging to deconstruct. So if you want to figure out if this is truly bad, we send this massive file off to our reverse engineers. Not a lot of companies have full-time reverse engineers and security researchers to tear through this kind of stuff. They might seem to do a sandbox, and it would completely defeat the sandbox.

It would get nothing from it. So our reverse engineers had to get through layers and layers of obfuscation, of encryption, because it was just, it hid in itself over and over again until we were finally able to tear through it all and understand what it did and how it did it. And that's how we really got the full concept of the attack. Well, at the risk of getting it a little bit in the weeds here,

one of the things that you highlight in the research is that the attackers intentionally launched the 32-bit version of PowerShell instead of the 64-bit version, which is more common these days. Again, why did they make that choice? So I mean, I think really just some of the older technologies, they don't have all of the same protections and all of the same detections maybe that the modern one did. So it was backwards compatible with previous usages and it just ran very effectively. So I think that was just the fact that they knew it was going to run. I think it's probably why they made the choice.

you make the point that the final payload is loaded entirely into memory help us understand the advantage there so yeah so most tools whether they be file-based or they be your eDR or even if you're writing a forensic investigation afterwards it's pretty reliance on something in the actual hard drive something being saved to a temp file or something of a file being saved somewhere on the computer in this case nothing was saved It all ran in memory, and it was encrypted in memory.

So there still are in-memory scanners that the traditional defenses try to run, and they do a pretty good job of it. But in this case, with the encryption running in-memory at the same time, nothing was found. We'll be right back. You know, none of these techniques individually seem to be brand new. What makes this campaign stand out? Is it the clever way that they're strung together?

Yeah, I think that's really, for me, that's really what it was, is the fact that the attackers seem to really anticipate the defenses. But you have any kind of file-based AV being bypassed by the polyglot MP3 file. You've got the AMC script scanning, right? The Microsoft's ability, anti-mower capability directly in the operating system. And that's being bypassed by patching in memory and, and twisting that flag so that it looks like there's no script there. It uses behavioral techniques with PowerShell to evade a, do a good job of evading any kind of

eDR telemetry, the sandbox, any kind of analysis that would follow. Again, very, very hard because of the size of 17 megabytes, the atomic IOCs, again, that's pretty much useless with every URL being unique to every individual computer. So I think just all of that working in concert with itself and the fact that even with a victim that had all of the defenses you would expect to identify this kind of attack create zero alerts. So I mean really I think the evasion and the scope of the attack

I think was really interesting. How do you rate this in terms of technical sophistication contrasted against just plain old good social engineering. I think the social engineering element is a part of this as well, again, with the SEO poisoning in the anthropic install page. But I think when you combine the sophistication of the attack with the social engineering, that's really what sets it apart. Don't get me wrong, any kind of fishing or fishing,

where you get somebody to click on something and you trick them into doing that is still a major concern right now. But a lot of the times, you would expect that to be found by something in your security stack. The fact that this uses both that social engineering lure

and then combines that with capabilities that are going to be found by your technical security stack, I think that's really kind of sets it apart. Let's talk about who they seem to be after here and what they seem to be after as well. Any indications there? So, yeah, they're targeting. It's an info stealer.

At the end of the day, that's after that launching of attacks or of techniques that we talked about, they launched an info stealer. They steals all the credentials. So the users, all their passwords, access to their bank accounts, say crypto accounts, their corporate logins. So all of the hidden passwords, what they access, and now that the user's guy can go in

and we'll have access to all those different accounts. So I mean, that's their target. This is a, it's more of a commodity style info stealers. So they're looking to, they're looking to monetize this. They're looking to take money. There was not a direct attribution. We know that this went back to Russian IP space.

We were not able to tie it to a known threat actor group. But, you know, the assumption is that it was a Russian cybercriminal group that was launching this attack and looking to, again, monetize it. So what are your recommendations for defenders to best protect themselves here? Well, I think, you know, it's a good question. I think it starts with the human side. That's if we don't fall for the click, fix lure, in the beginning and we don't you know the user is kind of a bit more educated and realizes it's not

necessarily required to run a command in normal install pages that's a good start and that starts from that kind of can stop it from the beginning i think there's a number of other elements there that if you know if you're corporate you have people that can do some hunting for you there's a few key things to look for like ms hTA should not be making outbound connections ht pt pt PS connections. There's almost no legitimate time when that would happen. So that's something to look for. Again, you talked about the 32 bit of PowerShell. It shouldn't be spawned from a comm registered scheduled task. That's, it's unusual. It should be looked for. So there's a lot of, you know, the DNS queries to the C2 domain out in Russia. That's something that you might want to block as well proactively. So, you know, all of these are items that,

that can be hunted for by a threat hunting team, and you can put in your EDR, hopefully be able to block that ahead of time. What about for the employees themselves? You know, I think it's understandable that people would be curious about these AI tools. Is there an educational component here as well to make sure that they're sourcing them from the proper places

or know how to handle them responsibly? Yeah, absolutely, Dave. I think that's kind of the key point, right? It is just a continued education, continued fishing simulations. Look for a year. Look in the URL where you're downloading from. If it's supposed to be Anthropic.com, and they can be really clever with this, right? I mean, sometimes even using Cyrillic languages for the A that looks just like an A in the English language.

So it's really hard sometimes to spot. lot, the differences. But looking to see if the URL matches, is this the official URL for where I'm supposed to be going? So doing everything they can to know that they're going the right way. And then even even then, especially with AI, one of the things we see, especially with our hunting team, one of the services we provide is identifying who's logging in in a client environment. Who's logging into AI locations? What are there different tools? What are they uploading? What are they downloading and you should really have a corporate AI where you're paying for a subscription and you have that guarded, uh, guarded off. So you're because of your, your, uh, employees that may be

uploading company's specific information is protected and not out in the public. So that's a real dangerous sign as well. So having something I think that is the go to, like this is the one you're allowed to install and having that be the only one that users can install is, is a good protection, especially when it comes to this kind of AI-based attack. Yeah, I mean, it strikes me that to think that these tools are anything but irresistible to certain users is maybe a bit naive. Our thanks to Brian Hussie from Saideris for joining us. The research is titled Bad Ads, Worst Bineries.

Fake-Claude Code installer drops info-stealer. We'll have a link in the show notes. And that's Research Saturday, brought to you by N2K Cyberwire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to Cyberwire at N2K.com. This episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.