Hackers created fake installation pages for Google Gemini and Anthropic Claude to steal users' passwords and data, prompting Microsoft to shut down its GitHub repositories and launch an emergency investigation.
Imagine this. Early in the morning, to finish your work twice as fast as usual, you try to install the latest AI assistant program on your computer, which has recently become highly popular among office workers. As soon as you search for the AI’s name in the Google search bar, a link that looks like the official website appears at the very top of the first page. You visit the site, copy a single line of installation command written on the screen, paste it directly into your computer, and press Enter. A message saying “Installation complete” pops up along with a familiar logo, and you take a sip of coffee feeling good that you’ve gained a reliable assistant. But in that mere split second, before you even noticed, your email password, automatic login credentials for banking sites, and even all the access rights to your company’s secure servers have completely fallen into the hands of hackers on the other side of the globe.
This is not a fictional movie scenario made up to grab your attention. This is exactly what is actually happening right now in 2026 to countless people who routinely use the cutting-edge AI tools created by giant tech companies like Google and Anthropic, as well as within the Microsoft ecosystem, which should boast world-class security. Recently, Microsoft faced an unprecedented crisis of having to forcibly shut down related projects after discovering signs of massive data leaks in its GitHub repositories Microsoft Hacked to Deliver Malware to Claude and Gemini Users. We will thoroughly explain the full story of this shocking hacking incident, why on earth such an absurd event occurred, and how we must deal with this invisible threat in a way that anyone can easily understand.
Why It Matters
Just a few years ago, the word artificial intelligence was a complex and distant technology handled only by scientists in labs or genius software engineers in Silicon Valley. But now, AI has completely entered our daily lives. Generative AI tools like Google’s ‘Gemini’ and Anthropic’s ‘Claude’ act as powerful ‘virtual omnipotent assistants’ that help office workers write project proposals, translate complex foreign language documents in an instant, and even allow beginners to easily write computer program code. Thanks to this overwhelming convenience, countless developers and general corporate users around the world are competitively installing these AI tools on their work computers.
The reason why this Microsoft hacking incident is truly frightening and important is that the hackers did not directly attack the core framework of AI technology itself, which is too strong to break. Instead, they perfectly weaponized human psychology: the ‘enthusiasm and blind trust of people in new and brilliant technology’. According to intensive investigations by cybersecurity researchers and media reports, even Microsoft, the world’s largest software company, had to launch an emergency investigation, shutting down its open-source GitHub (a massive online library where tens of millions of developers worldwide store, modify, and share code together) repositories related to its Azure cloud service and AI coding agents Microsoft’s open source tools were hacked to steal passwords ….
According to a Microsoft spokesperson officially speaking to a cybersecurity media outlet, attackers cunningly planted malware that secretly scrapes login credentials (such as passwords) stored on computers when ordinary users run AI coding tools like ‘Claude Code’ or ‘Gemini CLI’ Microsoft Hacked to Deliver Malware to Claude and Gemini Users. Here, CLI (Command Line Interface) refers to a method of giving instructions to a computer by directly typing text commands into a black terminal window, rather than the familiar mouse-click-based interface. It is an environment mostly used by professionals who prioritize speed and efficiency.
| Simply put, what does it mean if the development environments used by experts or the computer access rights of corporate employees are compromised? It’s not just on the level of losing a single personal social media account. This is akin to having the ‘master key to the safe’ stolen, which can control an entire company’s security system. Using the stolen privileges, hackers can access the company’s core databases or extract sensitive customer information [Fake Claude Code install pages hit Windows and Mac users with infostealers | Malwarebytes](https://www.malwarebytes.com/blog/news/2026/03/fake-claude-code-install-pages-hit-windows-and-mac-users-with-infostealers/). If even a tech industry giant like Microsoft failed to prevent a meticulous attack that occurred in its own backyard early on, and had to resort to the extreme measure of locking its doors, how precarious must the security defenses of ordinary individual users like us be? This is the core reason why we must pay attention to this incident. |
The Explainer
Then, how did these smart users and companies dealing with cutting-edge technology fall so helplessly into the hackers’ trap? Let us explain the two core hacking techniques the hackers used to perfectly deceive people in this attack by comparing them to everyday situations in a very easy-to-understand way.
1. SEO Poisoning and Typosquatting: “A Fake Restaurant with the Exact Same Sign as the Real One”
Researchers from EclecticIQ, a specialized cybersecurity firm, analyzed that this massive hacking attack was the result of a meticulously orchestrated global ‘SEO Poisoning’ campaign Fake Google Gemini and Claude Code Pages Used to Deliver …. Does it feel a bit difficult because of the technical terms? Let’s use an analogy.
Metaphorically, you opened the map app on your smartphone and searched for the name of a famous premium beef restaurant to visit with your family after a long time. The restaurant appeared at the very top of the search results with glowing reviews, and you followed the navigation without any suspicion. Upon arrival, the sign’s design, the interior decor, and even the font on the menu were perfectly identical to the real restaurant you saw on the internet. You finished your meal happily and handed over your card to pay. But in reality, that place was not the real restaurant; it was a ‘fake restaurant’ temporarily built on the street corner by a gang of robbers who cleverly changed just one letter in the name. The moment you handed over your card, all the information in your wallet fell into the hands of the robbers.
| The hackers’ methods were perfectly identical to this. They maliciously manipulated the algorithms of search engine systems like Google. When people searched for things like ‘install Google Gemini’ or ‘download Claude Code’ on their web browsers, they poisoned the search results so that the malicious websites they had carefully forged appeared at the top before the official homepage [Researchers Uncover SEO-Poisoned Sites Delivering Infostealers | Let’s Data Science](https://letsdatascience.com/news/researchers-uncover-seo-poisoned-sites-delivering-infosteale-ae66bf20). These fake websites looked eerily identical to the official sites operated by the actual companies, and even their internet addresses were decorated with names like gemini-setup[.]com, claudecode[.]co[.]com, or claude-setup[.]com, which are easy to be fooled by at a quick glance Fake Gemini and Claude Code Sites Spread Infostealers - Infosecurity Magazine. In the security industry, the despicable trick of preemptively registering internet addresses that can be confused with famous trademarks to use them for scams is called ‘Typosquatting’. |
2. Swapping the One-Liner Command: “Poison Secretly Put into a Famous Chef’s Sauce Packet”
| Users who walked right into the fake websites, the traps carefully laid out by hackers, now have to go through the final step of installing the program. To save time, modern users or developers highly prefer the so-called “one-liner installation command” method, where they copy and paste a single long text command into the computer terminal window, instead of clicking the mouse multiple times, which is complex and cumbersome. The hackers targeted this exact convenience. The screen of the fake installation page displayed a perfectly normal-looking installation command, but the moment the user copied it with their mouse, the hackers placed a magic-like trick in the invisible system backend that completely swapped it into a destructive command to download malware onto the computer [Fake Claude Code install pages hit Windows and Mac users with infostealers | Malwarebytes](https://www.malwarebytes.com/blog/news/2026/03/fake-claude-code-install-pages-hit-windows-and-mac-users-with-infostealers/). |
| This situation is just like buying a ‘meal kit’ made by a famous chef to easily cook at home, only to find out that someone secretly intervened during the distribution process and replaced the sauce packet inside with a deadly poison. The user merely poured the sauce into the pot purely as written in the instructions, but the result is a disaster. The moment the user copies and executes the fake command, a vicious spy program called a ‘PowerShell infostealer’ is quietly installed and operates within the computer’s memory without any pop-ups or warnings [Researchers Uncover SEO-Poisoned Sites Delivering Infostealers | Let’s Data Science](https://letsdatascience.com/news/researchers-uncover-seo-poisoned-sites-delivering-infosteale-ae66bf20). As the word suggests, an ‘Infostealer’ is a malware exclusively designed to glean and secretly ‘steal’ only the important ‘info(rmation)’ stored in the computer like a ghost. The prey this creature targets are all the digital assets owned by the computer’s owner, including internet site login passwords stored in the web browser, cookie information that lets you skip annoying logins, and developer privileges that can access the company’s sensitive systems [Fake Claude Code install pages hit Windows and Mac users with infostealers | Malwarebytes](https://www.malwarebytes.com/blog/news/2026/03/fake-claude-code-install-pages-hit-windows-and-mac-users-with-infostealers/). |
Where We Stand
Once this spy program breaches the computer’s defenses and enters inside, it maintains its vitality much more cunningly and persistently than expected. According to an in-depth analysis by Malwarebytes, a renowned security solution provider, the malicious script (VBScript, a tool that can issue powerful commands within the Windows system) that secretly infiltrated the user’s computer via the fake Claude site uses highly deceptive tactics to hide itself.
| As soon as this script is executed, it displays the shell of the actual, normal Claude AI application at the forefront of the computer screen. Seeing the familiar screen pop up, the user firmly believes, “Ah, the installation went perfectly fine.” However, in the invisible darkness behind the screen, this script quietly carries three fatal malicious files to the very heart of the computer. The place they settle in is deep inside the Windows system’s ‘Startup’ folder [Fake Claude site installs malware that gives attackers access to your computer | Malwarebytes](https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer). Having files registered here means that from now on, every time the user turns on the power of the computer, the hacker’s spy program will automatically run first without anyone’s permission. After finishing its job, the malicious script turns the original shortcut icon the user first clicked into a useless dead link, and perfectly destroys the evidence by deleting itself from the system [Fake Claude site installs malware that gives attackers access to your computer | Malwarebytes](https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer). It is truly an astonishingly meticulous criminal method. |
The process of siphoning the stolen treasure-like data back to their headquarters was also carried out under thorough disguise. The hackers did not lazily trade the stolen goods on a second-hand market like Craigslist. They disguised it perfectly as if using a conglomerate’s logistics network. The address of the so-called ‘C2 Server (Command and Control Server, the hackers’ central control headquarters that remotely controls numerous infected zombie computers and gathers stolen data)’ they built to transmit the stolen personal information was cunningly set as events[.]msft23[.]com SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer. ‘msft’ is an acronym conventionally used to abbreviate Microsoft in the IT industry worldwide. When administrators guarding corporate networks or security programs monitor the computer’s communication logs and see this address, they are misled into thinking that normal system data is coming and going to a legitimate official event server hosted by Microsoft, thereby leisurely slipping through the security surveillance net. Based on the source code of this malware, the structural characteristics of the server receiving the data, and the consistency of the social engineering tactics that manipulate human psychology, security experts are convinced that the hacker group wearing the shell of Gemini also attacked the users of Anthropic’s Claude Code in perfectly the same way SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer.
| But what angers and frustrates us is not just the loopholes in the technology. It is the irresponsible and disappointing attitude shown by the prominent big tech companies who bear the responsibility to solve this problem and protect their users. According to an explosive report published on the tech security blog grith in April this year, independent security researchers had already discovered a severe vulnerability that could allow confidential information to be leaked without authorization from the AI coding agent systems created by big tech companies such as Anthropic, Google, and Microsoft several months ago, and formally reported it to the companies [They Hacked Claude, Gemini, and Copilot (And No One Told You) | grith](https://grith.ai/blog/we-hacked-claude-gemini-copilot). |
| These three massive companies immediately acknowledged the severity of the problem and willingly paid a considerable amount of Bug Bounty (a massive reward paid by a company to a white-hat hacker who discovers a hacking vulnerability in the company’s system and formally reports it without secretly exploiting it) as a token of gratitude to the researchers who found the vulnerability. But that was all. They did not send a single warning email to ordinary users who could immediately face this massive security risk, and they completely ignored the procedure of issuing an official CVE (Common Vulnerabilities and Exposures, a serial number used in the security industry to announce fatal hacking risks, just like the CDC gives an official name to a new variant virus to notify medical professionals worldwide) to allow the global security industry to recognize and address the danger [They Hacked Claude, Gemini, and Copilot (And No One Told You) | grith](https://grith.ai/blog/we-hacked-claude-gemini-copilot). Rather than solving the problem fundamentally, they chose to silence it with money and quietly cover it up from the public eye. Regarding this, the researchers who wrote the report left a bitter remark: “You just didn’t know it, but this is the true current state of AI agent security we face living in 2026.” |
What’s Next
This incident is a painful warning letter clearly demonstrating what a flimsy and dangerous sandcastle the explosively grown AI industry that has swept the world is built upon. We can fully gauge how severe the matter is just by looking at the fact that Microsoft, the world’s top company, went as far as losing face to forcibly lock down its core assets, the GitHub open-source repositories, and launch an internal investigation into the cause Microsoft Hacked to Deliver Malware to Claude and Gemini Users.
In the future, the global software industry and cloud service companies will face a severe crisis of trust. It is highly likely that significantly stronger identity verification and rigorous code vetting procedures, on a completely different level from now, will be mandatorily introduced for every routine action of developers and ordinary users downloading, copying, and executing code on their computers from the vast ocean of the internet. Companies will have to overhaul their systems toward building strong security control systems, even if it means partially giving up the free culture of open source that used convenience as a weapon.
However, before waiting for corporate systems to become perfect, an urgent shift in awareness is also required from us users who must turn on our computers again for work tomorrow morning. Through this incident, we have painfully learned that just because a site is searched at the very top of a portal site, there is no guarantee anywhere in the world that it is the real official homepage. Before we newly invite an excellent, cutting-edge AI assistant that will dramatically help our work onto our computer, we must fiercely doubt and inspect with a magnifying glass whether the web address written on the ‘business card’ handed by that assistant is truly google.com or gemini-setup.com, cunningly crafted by twisting the spelling. No matter how magical the world has become where AI reads papers and writes code on its own, ultimately, the one who opens the tightly closed gates of my computer to hackers is the very finger of the user who mindlessly copies and clicks commands. We must never forget the fact that the ultimate shield protecting our precious digital assets is not the most outstanding artificial intelligence, but our very old and analog ‘caution’.
AI’s Take
MindTickleBytes AI Reporter’s View: The more dazzlingly technology advances and makes human life miraculously convenient, the more it provides hackers with vast and fertile hunting grounds that were previously unimaginable. We have entered an era where, as much as hastily adopting cutting-edge innovative tools, the ‘basics of security’—persistently questioning and doubting the true source of the tool I intend to rely on—is the most critical factor determining an individual’s digital survival. We cheer and welcome new AI innovations every day, but we must keep in mind that behind those innovations, an invisible threat aiming to exploit our carelessness is always lurking.
References
- Microsoft Hacked to Deliver Malware to Claude and Gemini Users
-
[Fake Claude site installs malware that gives attackers access to your computer Malwarebytes](https://www.malwarebytes.com/blog/scams/2026/04/fake-claude-site-installs-malware-that-gives-attackers-access-to-your-computer) -
[Researchers Uncover SEO-Poisoned Sites Delivering Infostealers Let’s Data Science](https://letsdatascience.com/news/researchers-uncover-seo-poisoned-sites-delivering-infosteale-ae66bf20) - SEO poisoning campaign leverages Gemini and Claude Code impersonation to deliver infostealer
- Fake Gemini and Claude Code Sites Spread Infostealers - Infosecurity Magazine
-
[They Hacked Claude, Gemini, and Copilot (And No One Told You) grith](https://grith.ai/blog/we-hacked-claude-gemini-copilot) -
[Fake Claude Code install pages hit Windows and Mac users with infostealers Malwarebytes](https://www.malwarebytes.com/blog/news/2026/03/fake-claude-code-install-pages-hit-windows-and-mac-users-with-infostealers) - Microsoft’s open source tools were hacked to steal passwords …
- Fake Google Gemini and Claude Code Pages Used to Deliver …
- It was a complex ciphertext that anyone could tell was a hacker's server
- It was perfectly identical to Google's official administrator server address
- It was disguised to look like Microsoft's official event server
- Inside the Startup folder of the Windows operating system
- Inside the Recycle Bin on the desktop
- Inside the web browser's download folder
- They paid bug bounties to the researchers but did not notify the users
- They immediately warned of the hacking fact through the global media
- They immediately issued an international standard Common Vulnerabilities and Exposures (CVE) number and patched the systems