JAKARTA - In March 2026, Kaspersky researchers discovered a malware campaign targeting developers through fake search ads for Claude Code, an AI tool made by Anthropic, which tricked users into installing sensitive data stealers.
When searching for "download Claude Code", the sponsored ad appears at the top of the search results, and directs users to a malicious web page that is very similar to the official installation documentation for Claude Code.
Instead of installing the development tool, the command copied from the fake site actually inserts malware into the victim's system.
This malware is designed to collect various sensitive information, ranging from login credentials, crypto wallet data, browser sessions, to other confidential files.
"If infected, the victim may unknowingly expose source code from active projects, confidential company data, authentication credentials, and personal accounts," said Vladimir Gursky, a cybersecurity expert at Kaspersky.
Kaspersky explained that the type of malware distributed differs depending on the operating system. On Windows, victims will be infected with Amatera, an infostealer that collects data from user directories, browsers, and crypto wallets before sending it to the attacker's server.
Meanwhile, on macOS, the malware distributed is AMOS, an infostealer that has been used several times in attack campaigns against Apple devices.
Kaspersky researchers also identified similar malicious campaigns targeting other popular AI tools, including OpenClaw and Doubao.
Using the same approach, the attackers registered several domains and distributed files containing the Amatera infostealer while disguising them as legitimate downloads for these tools.
"This makes such a campaign very dangerous for businesses whose developers rely on AI-assisted coding tools," he concluded.
The English, Chinese, Japanese, Arabic, and French versions are automatically generated by the AI. So there may still be inaccuracies in translating, please always see Indonesian as our main language. (system supported by DigitalSiber.id)
