Cybersecurity Today Fake Claude Code Installs, Arpa Phishing, Iranian and Russian Teams Mount Cyber Retaliation
5 snips
Mar 11, 2026 A scam used Google ads and cloned install pages to trick developers into running malicious terminal commands. Attackers abused .arpa reverse DNS and IPv6 blocks to host stealthy phishing links. A ZIP header manipulation trick hides compressed malware from scanners. Pro-Iranian and pro-Russian hacktivists ramped up DDoS, defacements, breach claims, and disinformation targeting the region.
AI Snips
Chapters
Transcript
Episode notes
Fake Claude Install Pages Deliver Credential Stealers
- Malvertised fake AI code installers trick experienced developers into running malicious terminal commands.
- Push Security found Google-sponsored ads linking to cloned Claude Code install pages that deploy Amatera/TeraStealer when users paste provided commands.
Treat Pasteable Install Commands As High Risk
- Revisit developer security practices and treat pasted install commands with suspicion.
- Push Security warns malicious domains spin up fast and short lifespans mean user caution and hardened controls matter more than IOCs.
Phishers Weaponize .arpa Reverse DNS To Evade Filters
- Attackers abused the special-use .arpa reverse DNS to host phishing redirects that evade typical domain reputation checks.
- They controlled IPv6 allocations and reverse DNS zones to create ANAME records pointing to phishing pages and used TDS filters to avoid analysis.