The rise of AI-powered coding assistants has significantly transformed the landscape of software development. However, along with the advantages, these advancements have also opened up new avenues for malicious actors in the realm of cybersecurity. Recent findings reveal that hackers are leveraging popular tools like Claude Code and OpenClaw to spread sophisticated data-stealing software, commonly referred to as infostealer malware. As a result, both personal and corporate environments are increasingly at risk.
Malvertising Campaign Targets AI Software Developers
A recent alert from Kaspersky highlights the method employed in this campaign—malvertising. When developers search for terms like “Claude Code download” or “OpenClaw download,” they may encounter deceptive advertisements at the top of their search results. These ads lead to websites that closely resemble the official pages of companies such as Anthropic or OpenAI.
While traditional software often uses standard installer packages to facilitate downloads, many AI developer tools require commands to be copied and pasted directly into terminal or command prompt interfaces. This can make it challenging for even seasoned users to recognize when they are executing harmful code.
A Tailored Attack for Every System
Depending on whether a user operates on Windows or macOS, the counterfeit download sites deliver different varieties of “infostealer” malware, which is designed to siphon off sensitive information.
Windows users often encounter Amatera, a type of malware known for infiltrating user directories, web browsers, and cryptocurrency wallets. This operates on a “Malware-as-a-Service” model, effectively making it a tool rented out to various criminal organizations. Conversely, macOS users are falling victim to AMOS (Atomic macOS Stealer), a notorious threat known for evading macOS security mechanisms to steal private information such as passwords and account credentials.
Why the Stakes Are So High
This issue extends beyond casual developers; professional developers frequently have access to crucial API keys, sensitive business data, and proprietary source code. According to Kaspersky’s cybersecurity expert Vladimir Gursky, any infection on a developer’s computer can jeopardize all ongoing projects and private records of the entire company.
To ensure safety, experts recommend avoiding the sponsored ads found in search results and instead directly accessing official documentation or trustworthy repositories like GitHub. In an age where “copy-pasting” has become an integral aspect of the workflow, verifying the authenticity of code sources has never been more vital.
