Cybercriminal campaigns targeting developers are evolving rapidly, and the latest operation observed by Ontinue’s Cyber Defense Center demonstrates a highly sophisticated abuse of trust within developer ecosystems. Attackers are now weaponizing counterfeit installation pages for popular development tools, including fake installers impersonating Claude Code, to deliver advanced information-stealing malware designed specifically to bypass Chromium’s Application-Bound Encryption (ABE) protections.
Unlike traditional phishing attacks, this campaign combines deceptive user experience design, stealthy PowerShell loaders, reflective process injection, COM interface abuse, and browser-native decryption workflows into a coordinated multi-stage intrusion chain. The result is a malware framework capable of extracting browser cookies, stored credentials, and payment data directly from Chromium-based browsers while evading many conventional detection systems.
Understanding the Threat Landscape
The campaign begins with fake sponsored search results that imitate legitimate Claude Code installation documentation. Victims searching for installation instructions are redirected to carefully crafted phishing pages that visually replicate authentic developer documentation. The malicious pages present users with what appears to be a legitimate one-line PowerShell installation command. However, instead of retrieving the official installer, the command silently redirects execution to attacker-controlled infrastructure.\
What makes this operation particularly dangerous is the deliberate separation between benign and malicious content. The /install.ps1 file hosted on the phishing domain actually contains a clean replica of Anthropic’s legitimate installer script, complete with SHA256 validation and authentic Google Cloud Storage downloads. Security scanners, reputation services, and automated crawlers therefore observe only harmless PowerShell content. The malicious behavior exists entirely within the HTML-rendered command shown to victims, allowing the operation to bypass many URL-analysis and reputation-based defenses.
This represents a major evolution in attacker tradecraft. Instead of embedding malware directly into downloadable scripts, the attackers manipulate user trust through visual deception while maintaining technically clean backend resources. Such separation significantly complicates automated detection and increases the likelihood of successful compromise.
Abuse of Chromium’s Application-Bound Encryption
Google introduced Application-Bound Encryption in Chrome 127 as a defensive measure against commodity infostealers that previously copied SQLite databases containing saved passwords and session cookies. ABE protects browser encryption keys by storing them behind an out-of-process Windows Elevation Service, which validates the caller before releasing decryption material.
The malware documented in this campaign directly targets that protection model. After execution, the PowerShell loader injects a lightweight native helper into a running Chromium-based browser process using classic process hollowing techniques, including CreateProcess, NtUnmapViewOfSection, VirtualAllocEx, WriteProcessMemory, and ResumeThread.
The injected helper then abuses Chromium’s own IElevator2 COM interface to recover the protected ABE encryption key. Rather than attacking encryption itself, the malware effectively asks the browser’s trusted Elevation Service to decrypt data on its behalf. This is a crucial distinction because it demonstrates the limitations of browser-side encryption once arbitrary code execution is achieved within the user’s context.
The helper itself is intentionally minimalistic. It contains no networking functions, no persistence mechanisms, no cryptographic libraries, and no file enumeration logic. Its sole purpose is to invoke Chromium’s COM interfaces and return decrypted keys back to the PowerShell loader through named pipes. This architectural separation dramatically reduces static detection opportunities and weakens behavior-based detection engines that rely on suspicious API combinations.
Sophisticated Evasion and Detection Resistance
One of the most technically interesting discoveries in this campaign is the malformed Microsoft Edge IElevator2 interface identifier embedded within the helper binary. The attackers introduced a two-byte transcription error in the GUID, changing 4047 to 4740. This causes the initial CoCreateInstance call against Edge 144 to fail, silently forcing the malware to fall back to Chromium’s legacy IElevator interface. Despite the failure, key decryption still succeeds.
Ironically, this implementation mistake creates one of the strongest detection opportunities for defenders. Because no legitimate Microsoft component will ever register the malformed GUID, security products can use it as a high-confidence signature for identifying related malware samples.
The malware also demonstrates awareness of modern operational security requirements. It excludes execution within CIS countries and Iran, likely to avoid regional law enforcement scrutiny. It uses Cloudflare-fronted infrastructure, selective HTTP responses, HTTPS communications, randomized PowerShell obfuscation, and dynamically generated identifiers to complicate analysis and attribution.
Persistence is established through scheduled tasks configured to poll attacker infrastructure every minute using headless PowerShell execution. Additional payloads can then be delivered dynamically through ZIP archives and tasking instructions returned from the command-and-control server.
Defensive Recommendations
Organizations should immediately strengthen PowerShell security controls, enable Script Block Logging, deploy AMSI monitoring, enforce Attack Surface Reduction rules against obfuscated scripts, and restrict execution from newly registered domains. Browser credential storage should be treated as highly sensitive, especially within developer environments where elevated privileges and long-lived authentication tokens are common.
Equally important is user education. Developers remain high-value targets because they frequently execute installation commands directly from documentation sites and terminal copy-paste workflows. Security awareness training must specifically address the risks of sponsored search results and visually deceptive installation instructions.
Our Opinion on This Campaign
This campaign represents a significant shift in how modern infostealers are being engineered. The attackers are no longer relying solely on commodity malware delivery or noisy credential theft techniques. Instead, they are building modular, low-footprint systems specifically optimized to evade modern detection pipelines while exploiting legitimate browser trust boundaries. The most concerning aspect is not the malware itself, but the operational maturity behind it. Supporting Chromium’s newly introduced IElevator2 interface within weeks of release demonstrates active development and continuous maintenance rather than recycled proof-of-concept code. The separation between the PowerShell loader and the native helper also reflects deliberate architectural planning aimed at frustrating defenders who analyze binaries in isolation.
We believe this attack chain highlights an uncomfortable reality for defenders: browser encryption alone cannot protect credentials once attackers achieve code execution within a trusted user session. As attackers increasingly abuse legitimate COM interfaces and native browser services, detection strategies must evolve beyond static signatures and simplistic malware classifications. Security teams should place greater emphasis on behavioral telemetry around PowerShell execution, COM object abuse, named pipe anomalies, and browser process injection rather than relying exclusively on antivirus signatures. Developer-focused phishing campaigns will likely continue to grow because developers possess privileged access, cloud credentials, API tokens, and software supply chain permissions that can lead to devastating downstream compromise. This operation is not merely another infostealer campaign. It is a preview of how future browser-targeting malware will operate in increasingly trusted and difficult-to-detect ways.
