Loading malware…
InstallFix is a ClickFix-style social-engineering malware-delivery technique that abuses cloned software-installation documentation and counterfeit installation pages. Victims are induced to copy and execute attacker-supplied terminal, shell, or Windows Run-dialog commands rather than install legitimate software. Campaigns have used malvertising and software-themed lures, including developer-tool and AI coding-assistant installation guides, to direct users to convincingly replicated documentation containing altered one-line installer commands.
On Windows, observed InstallFix execution chains use mshta and PowerShell to retrieve and execute staged code. A disguised polyglot carrier can establish persistence through a scheduled task, launch 32-bit PowerShell, and attempt to disable the Antimalware Scan Interface before subsequent payload execution. InstallFix has been used as a delivery route for Amatera Stealer, including in-memory loading intended to reduce detection by file-based controls. InstallFix-style campaigns have targeted Windows and macOS users, exploiting the widespread practice of pasting installation commands from web pages into local shells.
9 distinct techniques documented for this family, organized by ATT&CK tactic.
A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface before subsequent code runs.
It’s a variant of the ClickFix technique that presents a fake installation page (often a convincing clone of official documentation) and tricks the user into copying and running a malicious command.
Windows visitors can receive a separate InstallFix route that uses mshta and PowerShell. A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface.
After a visitor pressed Download, the page displayed an overlay that asked them to copy and paste a command... this approach makes users run attacker code.
It triggered a classic “ClickFix” social engineering prompt, instructing the visitor to copy and paste a terminal command to install the software.
A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface before subsequent code runs.
A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface before subsequent code runs.
The subsequent stages used arithmetic fog, opaque predicates, and shellcode to inject the Amatera Stealer PE directly into memory.
A polished page claimed to offer a native HBO Max app for macOS... The operation linked fake streaming ads with lures for AI tools, developer utilities and disk-cleaning software.
Windows visitors can receive a separate InstallFix route that uses mshta and PowerShell. A disguised MP3/HTA file can create a scheduled task.
A disguised MP3/HTA file can create a scheduled task, launch 32-bit PowerShell and disable the Antimalware Scan Interface before subsequent code runs.
42 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.