Malicious and unsafe use of Anthropic Claude Code leading to malware delivery and destructive infrastructure changes

Timeline

1. May 1, 2026

   NordVPN uncovers malware campaign impersonating Google Gemini CLI

   NordVPN reported active campaigns using fake websites, cloned repositories, deceptive social posts, and planned typosquatted npm packages to impersonate Google Gemini CLI and trick developers into installing malware. The macOS variant used a Base64-encoded terminal command to download and run a malicious script with elevated privileges, while the Windows variant used a disguised PowerShell fileless attack to provide remote access and enable theft or lateral movement.

2. Apr 15, 2026

   Expel reveals InstallFix scale and MSIX-based Claude Code variant

   Expel reported that InstallFix-style fake software install pages had become widespread, accounting for 13% of malware incidents it observed in March 2026, and identified 46 malicious Anthropic-themed webpages over the prior month. The firm also described a GitLab.io-hosted fake Claude Code page that used mshta to fetch a file named claude.msixbundle containing hidden malicious HTML as an anti-analysis technique.

3. Mar 10, 2026

   Google deactivates advertiser account tied to fake Claude Code campaign

   Bitdefender said the malicious ad campaign likely used a compromised advertiser account associated with a Malaysian company. Google reportedly deactivated that advertiser account after the abuse was identified.

4. Mar 10, 2026

   Bitdefender documents Windows and macOS malware from fake Claude Code ads

   Bitdefender reported that a fake Claude Code documentation site hosted on a Squarespace subdomain delivered OS-specific malware via ClickFix-style instructions. On Windows it deployed multi-stage stealer payloads, while on macOS it delivered an obfuscated universal Mach-O backdoor capable of remote shell execution.

5. Mar 10, 2026

   Push Security links Windows infection chain to Amatera Stealer

   Analysis of the fake Claude Code campaign showed Windows victims were led through a staged execution chain involving cmd.exe and mshta.exe to retrieve attacker-hosted payloads. The resulting malware was identified as Amatera Stealer, an infostealer targeting credentials, cookies, tokens, and system data.

6. Mar 9, 2026

   Researchers identify fake Claude Code install pages in Google ads

   Security researchers reported a malvertising campaign using lookalike Claude Code installation pages and sponsored Google Search results to trick users into copying malicious install commands. The tactic was described as an "InstallFix" attack that weaponizes trusted one-line terminal commands.

7. Mar 8, 2026

   Amazon Business Support helps restore deleted AWS data

   After the destructive Terraform action, Grigorev contacted Amazon Business Support, which assisted with restoring the lost data. The recovery reportedly took about a day.

8. Mar 7, 2026

   Grigorev publishes post-mortem and hardening changes

   In a post-mortem, Grigorev said he would test restores, add deletion protections and tighter permissions, move Terraform state to S3, and require manual review and execution for destructive actions instead of letting the AI agent run them directly.

9. Mar 7, 2026

   Developer's Claude Code/Terraform run destroys two AWS website environments

   During a migration of AI Shipping Labs to AWS infrastructure shared with DataTalks.Club, Alexey Grigorev provided Terraform state late, causing Claude Code to follow that state and execute a Terraform destroy. The action wiped both sites' infrastructure, including a database and snapshots containing about 2.5 years of records.