Social-engineering malware delivery via trusted installation and download paths

Security researchers reported two active/feasible malware-delivery patterns that abuse user trust in “normal” software acquisition flows rather than exploiting a specific browser or OS vulnerability. LayerX demonstrated a proof-of-concept Chrome add-on (Totally Innocent Extension) that can silently modify executables as they are downloaded—including from legitimate vendor sites—by appending attacker-controlled code without breaking the original application or requiring additional extension permissions, enabling follow-on outcomes such as persistence, lateral movement, and data theft. The researchers said the technique highlights gaps in browser extension security controls; Google and Mozilla did not acknowledge it as a product issue, with Google indicating social-engineering-driven intrusions fall outside its browser threat model.

Separately, Push Security documented InstallFix, a new variant of the ClickFix social-engineering technique, where attackers clone installation pages for popular CLI tools and replace the install steps with malicious “copy/paste” commands (e.g., curl-to-shell patterns) that fetch payloads from attacker infrastructure. A noted example used a cloned Claude Code (Anthropic) CLI install page that preserved legitimate branding and redirected most links back to the real site, while only the macOS/Windows install instructions delivered malware; the pages were promoted via Google Ads malvertising for searches like “Claude Code install,” increasing the likelihood of developer and non-developer victims executing the malicious commands.