Fake AI installers: when 'paste this command' is the attack

Everyone wants to try the latest AI tool, and scammers know it. One of the most common tricks right now is a cloned download page that asks you to paste a single command into Terminal or the Run box. That one command is the malware. No attachment, no dodgy .exe, and often nothing for email filters to catch.

How the trick works

The pattern goes by a few names. ClickFix is the general one: a web page persuades you to copy a command and run it yourself. InstallFix is the AI-flavoured version, where the page is a copy of a real install page for a tool such as Claude Code or ChatGPT.

A typical run looks like this:

Someone searches for something like "download claude code" or "claude mac".
A sponsored result at the top of the page looks official. In one case reported by Push Security, the ad even showed bing.com as its address, because it bounced through a legitimate click-tracking redirect first.
The landing page copies the real documentation layout. Bitdefender found one hosted on a Squarespace subdomain.
The page shows a normal-looking install command. But the copy button puts a different command on the clipboard.
The person pastes it into Terminal or a Windows prompt. The command fetches a script and runs it in memory.

Bitdefender's analysis of fake Claude Code ads showed both sides. On Windows the command used mshta.exe, a genuine Microsoft program, to pull down and run a payload that ended in a password stealer. On a Mac it was an encoded command piped into zsh that downloaded a program, removed its extended attributes, made it executable and ran it as a backdoor. There was no installer and no warning.

Why it gets past normal defences

This works because the user does the risky part themselves, using tools the operating system trusts. A few things make it worse:

It starts in search, not email. Push Security says four in five ClickFix pages it intercepted in 2026 were reached from search engines, through malvertising, poisoned results and hacked websites. Your email filter never sees them.
The lure can sit on a trusted site. Attackers create shared ChatGPT or Claude chats and artifacts that contain malicious install steps. Because the link is on chatgpt.com or claude.ai, reputation checks may trust it.
The command runs in memory. Nothing is saved to disk at first, so file scanning has less to go on.
Developer and Mac machines are often less protected. These are exactly the people most likely to install a new AI coding tool.

The numbers are big, though most come from security vendors with products to sell, so treat them as a guide. Push says ClickFix made up 67% of its detections in August 2026. It also quotes Microsoft's 2026 Digital Defense Report: ClickFix-style commands ran on more than 1.1 million unique devices between February and early May.

What to put in place

1. Give people one place to get software

The best fix is to remove the need to search. Publish approved AI tools through Intune and Company Portal, or a short internal page with the real links. If someone wants a tool that isn't on the list, they ask. That is quicker than cleaning up a stolen browser session.

2. Teach one simple rule

"No website will ever need you to paste a command to prove you're human or to install an app. If it asks, stop and ask IT." Real developer tools do use install commands, so for technical staff, add a second rule: only copy commands from the vendor's own domain, reached by typing it, not from an ad.

3. Skip sponsored search results for downloads

Bitdefender's advice is plain and worth repeating: avoid ads when searching for software and check the domain carefully. Bookmarks for the tools people use are a cheap win.

4. Turn on browser and Windows protection, and don't let people click past it

Microsoft Defender SmartScreen checks sites and downloads against Microsoft's reputation data. On managed devices, turn it on and stop users from ignoring its warnings. Today's tutorial walks through it in Intune.

5. Limit what pasted commands can do

Most office users never need mshta.exe, the Run box or a script prompt. Attack surface reduction rules, application control and standard (non-admin) accounts all reduce the damage a pasted command can do. Test any blocking rule on a pilot group first, because some line-of-business apps rely on these tools.

6. Cover the Macs and developer laptops

Make sure Macs and developer machines have the same endpoint protection and monitoring as everything else. They are a big part of the target audience for fake AI tool pages.

7. Plan for when it happens

If someone has pasted a command, assume their browser sessions and saved passwords are gone. Isolate the device, revoke the user's sessions in Entra ID, reset their password, and check for new mailbox rules and MFA methods. Then rebuild the device rather than trying to clean it.

The bottom line

AI tools are the bait, but the hook is old: get the user to run something. You won't stop every ad or cloned page. You can make sure people know where to get software, that "paste this command" is a red flag, and that if one slips through, the device can't do much damage.

Sources

← All posts