Developers hunting for the latest Anthropic tool now face a calculated risk. Search Google for “Claude Code install” or “Claude Code CLI.” The top result might not lead to code. It leads to compromise. Since March 2026, attackers have flooded results with cloned pages. They mimic Anthropic’s documentation pixel for pixel. The layout matches. The fonts match. Even the sidebar navigation fools the eye. But one command differs. Users copy it. They paste it into a terminal. And the trap closes. Push Security first exposed the pattern in early March. The firm named it InstallFix. A twist on the older ClickFix tactic. No fake error message. No CAPTCHA. Just swapped instructions on a page that looks official. Push Security noted the danger. “Unless you’re carefully reading the URL embedded in the install one-liner (and let’s be honest, almost nobody does these days), the page is indistinguishable from the real one.” But the campaign runs far broader. Straiker researchers tracked 88 domains.…