A little help from your search engine. [Research Saturday]

Summary

---

CyberWire Daily [Research Saturday]

Episode Title: A little help from your search engine
Release Date: August 8, 2026
Host: Dave Bittner (A)
Guest: Brian Hussey (B), SVP, Howler Cell Threat Services at Sideeris
Episode Theme:
A deep dive into a recent, highly evasive malware campaign leveraging SEO poisoning to distribute a credential-stealing infostealer disguised as a legitimate Claude code installer for AI-curious users, and analysis of how this attack bypassed multiple layers of traditional and advanced cybersecurity defenses.

---

Overview

This episode investigates an advanced malware campaign that cleverly used search engine optimization (SEO) to lure victims seeking to install Anthropic’s Claude AI code tool. The campaign targeted both the technically inexperienced and businesses exploring new AI tools, leveraging social engineering and technical ingenuity to bypass security. The research, titled “Bad Ads, Worse Binaries, Fake Claude Code Installer Drops Infostealer” by Sideeris, reveals how the attackers evaded detection and harvested user credentials at scale.

---

Key Discussion Points & Insights

1. Storytelling and Victim Profile

• Narrative: The research frames the attack from the viewpoint of a first-time developer or AI-interested individual trying to install “Claude code,” emphasizing how easy it is for non-experts to fall prey.

• Context: The popularity of AI tools, the flood of new users, and the lack of expertise create a perfect target pool for attackers.

  “You’ve got all of these people...that realized suddenly, hey, I can go build things, I’m not a coder, but I can go make an app...So you’ve got all of these people that are launching towards AI...and are met with this page and they don’t know.”
  — Brian Hussey (B) [01:49]

• Scale of Victims: Could be anyone — teachers, small business owners — looking to harness AI.

---

2. Attack Flow and Technical Walkthrough

• Entry Point: Victims search for “Claude code install” and encounter a top search result mimicking Anthropic’s site (but Anthropic itself was not compromised).

• Social Engineering Trick: Users prompted to run a command (the “click fix lure”), which triggers the attack chain.

• Malicious Polyglot File: A downloaded MP3 that plays music and appears legitimate, but contains embedded malicious code.

  “This polyglot file is an MP3...it plays music...and more importantly, it looks legitimate to the Windows operating system.”
  — B [03:56]

• Execution Chain:

  • User pastes command invoking mshta.
  • Polyglot MP3 runs a malicious script, launching a memory-resident PowerShell loader.
  • AMSI (Microsoft Anti-malware Scan Interface) is disabled to block script scanning.

• In-Memory Malware: Entire payload loads and executes from memory, leaving no artifacts on disk, encrypted at all times.

---

3. Evasion Tactics

• Large Script Size: The downloaded payload is a massive, obfuscated 17 MB script—intentionally designed to defeat automated and sandbox-based malware analysis.

  “They might simply do a sandbox and it would completely defeat a sandbox...layers and layers of obfuscation of encryption because it...hid in itself over and over again...”
  — B [06:12]

• PowerShell Version: Campaign uses the 32-bit version of PowerShell, evading newer defense mechanisms and ensuring compatibility.

• Unique C2 URLs: Each victim’s device connects to a unique command-and-control (C2) URL, defeating atomic IOCs like hashes or IPs.

---

4. Combining Technical Sophistication & Social Engineering

• Attack Stands Out: Not one technique is novel; the mastery is in seamlessly chaining known evasion tricks and predicting defender responses.

  “The attackers seem to really anticipate the defenses...all of that working in concert...even with a victim that had all of the defenses you would expect...create zero alerts.”
  — B [09:03]

• Dual Threat: Social engineering with SEO poisoning + highly technical, in-memory, anti-forensic payload.

---

5. Purpose and Attribution

• Objective: The campaign’s end goal is credential theft — personal, financial, crypto, and enterprise logins.
• Attribution: Links traced to Russian IP space but no hard connection to specific threat actors. Motive appears to be financial (commodity infostealer).

---

6. Defensive Recommendations & Awareness

• For Security Teams:

  • Monitor for unusual behavior like mshta making external connections, 32-bit PowerShell spawned abnormally, or DNS to known C2 destinations.
  • Threat hunting teams should proactively block or investigate such artifacts.

• For End Users:

  • Be wary of installation processes requiring unusual command-line interaction.
  • Double-check URLs — attackers use tricks like Cyrillic characters to mimic legitimate domains.
  • Prefer corporate-sanctioned AI tools and centralize access when possible.

  “There’s almost no legitimate time [MSHTA] would make outbound connections...Even using Cyrillic languages for the ‘A’ that looks just like an A in the English language...So it’s really hard sometimes to spot the differences.”
  — B [12:42], [14:24]

• Ongoing User Education: Simulate phishing, repeat training, and foster critical awareness—especially given AI’s allure.

---

Notable Quotes & Memorable Moments

• On victim profile and attack framing:
  “So we feel like the victim footprint is really large, taking advantage of the AI world that we’re in today.” (B) [01:49]

• On the polyglot MP3:
  “It plays music, it looks legitimate...even though it has that malicious script embedded in it.” (B) [03:56]

• On the challenge to defenders:
  “Not a lot of companies have full time reverse engineers and security researchers to tear through this kind of stuff...it hid in itself over and over again.” (B) [06:12]

• On perfect evasion:
  “Even with a victim that had all of the defenses...zero alerts.” (B) [09:03]

• On the irresistible lure of AI tools:
  “To think that these tools are anything but irresistible to certain users is maybe a bit naive.” (C) [15:54]

---

Important Timestamps

• [01:10]: Introduction of Brian Hussey and summary of the research focus
• [03:36]: Step-by-step walk through of how the attack unfolds for a victim
• [06:01]: Discussion on the unusually large payload and evasion tactics
• [07:06]: Use of the 32-bit PowerShell for further evasion
• [07:59]: Entire payload running only in memory
• [09:03]: The orchestration of several evasion strategies
• [11:24]: The real-world goals: credential and financial theft
• [12:42]: Concrete recommendations for security teams and defenders
• [14:24]: Education and the subtlety of domain lookalikes
• [15:54]: The innate appeal — and danger — of hot new AI tools

---

Tone & Language

The conversation is technically detailed but accessible, balancing practical guidance with clear explanations. The speakers display urgency about new threats, emphasize the sophistication of the attack, and repeatedly urge renewed vigilance and user education.

---

Conclusion

This episode is a critical listen for cybersecurity professionals, educators, and anyone adopting AI tools. It exposes how rapidly evolving threats are targeting curious, less-defended users and adeptly bypassing layered corporate defenses. The synthesis of technical evasion and cunning social engineering signals a new paradigm in malware delivery—one where traditional defenses can be defeated and user education is more essential than ever.

---

Transcript

[A]

You're listening to the Cyberwire Network powered by N2K. Hello everyone and welcome to the Cyberwires Research Saturday. I'm Dave Bittner and this is our weekly conversation with researchers and analysts tracking down the threats and vulnerabilities, solving some of the hard problems, and protecting ourselves in a rapidly evolving cycle cyberspace. Thanks for joining us.

[B]

We were able to identify a really sophisticated attack malware campaign and that evaded the client's entire security stack. But we found it really, really interesting because of some of the creative techniques it used, some of the ways it bypassed security mechanisms and was able to really expand victim footprint. So we decided to dig deep, do the analysis and publish on it.

[A]

That's Brian Hussey, senior vice president of Howler Cell Threat Services at Sideeris. The research we're discussing today is titled Bad Ads, Worse Binaries, Fake Claude Code Installer Drops, infosteeler.

[C]

Well, the research is a really effective story here. The storytelling itself is noteworthy and you all begin the report with a first time developer who's trying to install Claude code. Why was it important to frame the story around that person?

[B]

Well, that's just it. One of the things I think that made the story really interesting was its effectiveness of how it used SEO. I think any advertising firm would be very proud of the fact that this was able to get on, on front page for Google and other search engines. And really what that means is it took advantage of AI, which is the rage right now. You've got all of these people that I realized suddenly, hey, I can go build things, I'm not a coder, but I can go make an app. I can go do things and create things that was never possible before and use AI in a way that to make them more effective. That's what we're all doing. So you've got this legion of people that are looking up Anthropic, looking up Claude, looking up chatgpt, anything like that. And when the first page and the first, in some cases the first link is to download a site that mimics Anthropic, it's important to say Anthropic is not compromised. This was a fake install site, but it mimicked Anthropic very, very well. So you've got all of these people that are launching towards AI, wanting to build something they've never built before and are met with this page and they don't know. They may not have the threat background that a lot of folks do. They may not have all the security mechanisms that some of the corporates do. So we feel like the victim footprint is really large, taking advantage of the AI world that we're in today. And so that's part of the reason we wanted to kind of frame it like that. Say, could be a teacher, could be, could be a small business person. And they're trying to leverage AI to improve their business or do something they haven't done before and they're being taken advantage of.

[C]

Well, let's walk through it together. You know, let's imagine that I'm one of those folks you described who's curious about this, what all the hype is around AI and Claude code in particular. So I do a Google search or any of the search engines for Claude code install. What happens next?

[B]

Well, so right up at the top of your page, you've got the link that looks correct. You click on it and from there the whole ATT and CK chain starts to run. After you click on that link, you get the legitimate looking site, you go to the download and there's a original click fix lure which is really, really popular. In fact, I think even on your show a few weeks ago, you had a deep dive into that. So they trick the user into pasting something into the Windows Run dialog command line that launches the mshta from there. I think the attack gets really interesting because it downloads this polyglot file. What polyglot means is it can be two things, two legitimate things at once. So this polyglot file is an MP3, it is a. It's a music file, it's legitimate, it plays music, it looks legitimate to the user, and more importantly, it looks legitimate to the Windows operating system. So this is even though it has that malicious script embedded in it. So that malicious script runs that launches directly into a new PowerShell loader and that disables AMSI. So AMSI is the Microsoft anti malware capability. And from this point on, this runs completely in memory. Nothing touches a hard drive. It's all decrypted, does a very good job of hiding from traditional defenses. But again, it bypasses the Windows amsi, the anti malware capability, and then it accesses everything on the computer, creates an interesting. I thought this was interesting as well, because it really disables the ability to use traditional threat intelligence, atomic IOCs, like hashes, domains, IPs, because it reaches out to a unique URL based on the computer's host name and the username runs a very large script, 17 megabytes. This is a massive script.

[C]

Yeah, let me interrupt you there, because as you say, that is Big why would attackers intentionally make such a large file? It would strike me that that would draw attention to itself.

[B]

Well, in fact, just the opposite. It. Well, it didn't in fact draw attention from any of the anti malware capabilities, but what it did, it made it very challenging to deconstruct. So if you want to figure out if this is truly bad, we send this massive file off to our reverse engineers. Not a lot of companies have full time reverse engineers and security researchers to tear through this kind of stuff. They might simply do a sandbox and it would completely defeat a sandbox. It would get nothing from it. So our reverse engineers had to get through layers and layers of obfuscation of encryption because it was just, it hid in itself over and over again until we were finally able to tear through it all and understand what it did and how it did it. And that's how we really got the full concept of the attack.

[C]

Well, at the risk of getting a little bit in the weeds here, one of the things that you highlight in the research is that the attackers intentionally launched the 32 bit version of PowerShell instead of the 64 bit version, which is more common these days. Again, why did they make that choice?

[B]

So, I mean, I think really just some of the older technologies, they don't have all of the same protections and all of the same detections maybe that the, the modern one did. So it was backwards compatible with, with previous usages and it just ran very effectively. So I think that was just the fact that they knew it was going to run, I think is probably why they made the choice.

[C]

You make the point that the final payload is loaded entirely into memory. Help us understand the advantage there.

[B]

So, yeah, so most tools, whether they be file based, whether they be your EDR or even if you're running a forensic investigation afterwards, is pretty reliant on something in the actual hard drive, something being saved to a temp file or something, a file being saved somewhere on the computer. In this case, nothing was saved. It all ran in memory and it was encrypted in memory. So there still are in memory scanners that the traditional defenses try to run and they do a pretty good job of it. But in this case with the encryption running in memory at the same time, nothing was found.

[C]

We'll be right back. You know, none of these techniques individually seem to be brand new. What makes this campaign stand out? Is it the clever way that they're strung together?

[B]

Yeah, I think that's really, for me, that's really what it was, is the fact that the attackers seem to really anticipate the defenses. So you have any kind of file based AV being bypassed by the Polyglot MP3 file, you've got the AMC script scanning, right. The Microsoft's ability anti malware capability directly in the operating system and that's being bypassed by patching in memory and twisting that flag so that it looks like there's no script there. It uses behavioral techniques with PowerShell to evade do a good job of evading any kind of EDR telemetry, the sandbox, any kind of analysis that would follow. Again, very, very hard because of the size of 17 megabytes, the atomic IOCs. Again that's pretty much useless with every URL being unique to every individual computer. So I think when you know just all of that working in concert with itself and the fact that even with a victim that had all of the defenses, you would expect to identify this kind of attack, create zero alerts. So I mean really, I think the evasion and the scope of the attack I think was really interesting.

[C]

How do you rate this in terms of technical sophistication contrasted against just plain old good social engineering?

[B]

I think, you know, the social engineering element is a part of this as well. Again with the SEO poisoning in the anthropic install page. But I think when you, when you combine the sophistication of the ATTCK with the social engineering, that's really what sets it apart. Don't get me wrong, any kind of phishing or vishing where you get somebody to click on something, you trick them into doing that is still a major concern right now. But a lot of the times you would expect that to be found by something in your security stack. The fact that this uses both that social engineering lure and then combines that with capabilities that aren't going to be found by your technical security stack, I think that's really kind of sets it apart.

[C]

Let's talk about who they seem to be after here and what they seem to be after as well. Any indications there?

[B]

So yeah, they're targeting, it's an info stealer at the end of the day that's after that long chain of attack or of techniques that we talked about. They launched an info stealer that steals all the credentials so your, the users, all their passwords, access to their bank accounts, you know, say crypto accounts, their corporate logins. So all of the, the hidden passwords, what they access and now that the user's got it can go in and we'll have access to all those different accounts. So I mean that's, that's their target. This is a, it's more of a commodity style info stealer. So they're looking to, they're looking to monetize this, they're looking to take money. There was not a direct attribution. We know that this went back to Russian IP space. We were not able to tie it to a known threat actor group. But, you know, the assumption is that it was a Russian cyber criminal group that was launching this attack and looking to again, monetize it.

[C]

So what are your recommendations for defenders to best protect themselves here?

[B]

Well, yeah, I think, you know, it's a good question. I think it starts with the human, human side. That's if we don't fall for the click fix lure in the beginning and we don't, you know, the user is kind of a bit more educated and realizes it's not necessarily required to run a command in normal install pages. That's a good start. And that starts from, that kind of can stop it from the beginning. I think there's a number of other elements there that if, assuming you have a soc, you have, you know, if you're with corporate, you have people that can do some hunting for you. There's a few key things to look for. Like MSHTA should not be making outbound connections, HTTPs connections. That's. There's almost no legitimate time when that would happen. So that's something to look for. Again, you Talked about the 32 bit PowerShell. It shouldn't be spawned from a COM registry scheduled task. It's unusual. It should be looked for. There's a lot of the DNS queries to the C2 domain out in Russia. That's something that you might want to block as well, proactively. All of these are items that can be hunted for by a threat hunting team and you can put in some in your edr, hopefully be able to block that ahead of time.

[C]

What about for the employees themselves? I think it's understandable that people would be curious about these AI tools. Is there an educational component here as well to make sure that they're sourcing them from the proper places or know how to handle them responsibly?

[B]

Yeah, absolutely, Dave. I think that's the, that's kind of the key point, right, Is just a continued education, continued fishing simulations. Look for, look for your, look in the URL where you're downloading from if it's supposed to be anthropic.com and they can be really clever with this. Right. I mean, sometimes even using Cyrillic languages for the A that looks just like an A in the English language. So it's really hard sometimes to spot the differences. But looking to see if the URL matches, is this the official URL for where I'm supposed to be going? So doing everything they can to know that they're going the right way. And then even then, especially with AI, one of the things that we see, especially with our hunting team, one of the services we provide is identifying who's logging in in a client environment, who's logging into AI locations, what are their different tools, what are they uploading, what are they downloading. And you should really have a corporate AI where you're paying for a subscription and you have that guarded, guarded off. So your custody or your employees may be uploading. Company specific information is protected and not out in the public. So that's a real dangerous sign as well. So having something I think that is the go to, like this is the one you're allowed to install and having that be the only one that users can install is a good protection, especially when it comes to this kind of AI based attack.

[C]

Yeah, I mean it strikes me that to think that these tools are anything but irresistible to certain users is maybe a bit naive.

[A]

Our thanks to Brian Husser from Sidearis for joining us. The research is titled Bad Ads, Worse Binaries, Fake Claude Code, Installer Drops, infosteeler. We'll have a link in the Show Notes and that's Research Saturday, brought to you by N2K CyberWire. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the Show Notes or send an email to cyberwire2k.com this episode was produced by Liz Stokes. We're mixed by Elliot Peltzman and Trey Hester. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here next time.