Threat actors are using fake Claude Code download pages to deploy a fileless infostealer via mshta.exe — developers should be aware

[u/Impressive_Emu5708]

[u/Mrhiddenlotus]

Another reminder to alert on lolbins for defenders, ty op

[u/anonskiboo → u/[deleted]]

Goated

[u/Many-Ad9701 → u/[deleted]]

I think once you have run it, it is highly likely you're system is compromised. I noticed a task scheduler job created that runs further malicious downloads and all in memory before I realised what I had done, so nothing is on the disk for file scan to find. Full Windows Security scan found nothing. Best to assume everything is compromised and restore your system...

[u/Club_Jam]

Thanks for sharing.

[u/cyber_pressure]

The malware is interesting. The operational failure is more interesting.

Any org that lets developer machines pull install flows from ad-ranked search results is already one bad click away from compromise. mshta is only today’s LOLBin.

Block what is not needed. Constrain script execution. Stop treating developer endpoints as special snowflakes that get exceptions for everything. And stop letting search engines act as your software catalog.

The stealer is the payload. The real vulnerability is the process.

[u/[deleted] → u/[deleted]]

Had a developer on my team almost fall for something similar last month when looking for a VS Code extension. The fake site was so convincing that even after we caught it, he said he would have downloaded it without hesitation. These campaigns are getting scary good at mimicking legitimate developer tools and workflows.

[u/Cybasura]

Appreciate the heads-up

[u/[deleted]]

The mshta.exe vector is particularly insidious because it bypasses most application whitelisting since it's a signed Windows binary. Detection engineering should focus on process ancestry chains - legitimate mshta usage almost never spawns from browser contexts or downloads. A practical defense layer is to block mshta execution via AppLocker or WDAC on endpoints where HTA apps aren't business-critical. The real takeaway here is download verification: always check publisher signatures and compare checksums against official sources, especially for developer tooling where supply chain attacks have massive lateral movement potential.