Fake AI Installers: When "Installing Claude" Turns Into Running Malware

A practical security case study about fake AI tool install pages, clipboard command substitution, and why copy-pasting terminal commands from search results has become a real workstation risk. Introduction This is not a Claude vulnerability. It is not a story about "AI tools are dangerous" either. It is about a much more ordinary problem: developers are used to copying install commands from the browser into the terminal Attackers are now abusing that habit. The old phishing pattern was familiar: