A sophisticated phishing operation is delivering malware by impersonating Anthropic's Claude Code website. The fraudulent site, a near-perfect copy of the official download page, is designed to trick developers into installing a malicious command-line tool.

Claude Code, Anthropic's terminal-based coding assistant launched in early 2025, has seen rapid adoption. Its popularity now makes it a target. Attackers registered a deceptively similar domain and built a convincing replica. Developers following the site's installation instructions inadvertently run a compromised package that can steal data or create backdoors.

The attack exploits standard developer behavior: copying a command from a web page and pasting it directly into a terminal. There's no email attachment to scrutinize; one mistaken command executes arbitrary code. This threat emerges as search interest for installing AI coding tools has surged, creating opportunities for malicious sites to appear in search results.

This is part of a trend. Security researchers note a rise in typosquatting attacks on npm packages and spoofed repositories as attackers follow developer interest toward new AI tools.

To stay safe, install Claude Code only via the official npm package (`npm install -g @anthropic-ai/claude-code`). Scrutinize URLs, bookmark the genuine site, and never copy commands from unverified pages. If you suspect a compromised installation, immediately rotate any API keys or credentials that were on the affected machine.

Anthropic directs users to its official channels but has not released a specific statement on this campaign. The safest source remains its verified npm organization.

The incident underscores a wider security challenge. As new AI developer tools emerge weekly, the rush to adopt them can outpace caution. A single compromised workstation can risk broader systems. Verifying installation sources, even when they look flawless, is now a fundamental part of development hygiene.

Source: Webpronews