Fake websites on Google Sites impersonate Claude Code and steal passwords without downloading a file. The ClickFix technique and in-memory attacks bypass traditional antivirus tools.
How the campaign works
The victim is directed to a page hosted on Google Sites, which at first glance looks like the official installation guide for Claude Code or OpenAI Codex. The page prompts the victim to run a short command using mshta.exe—a standard Windows tool that doesn’t raise any suspicion.
This triggers a multi-stage PowerShell sequence that runs entirely in memory. The malicious payload is hidden in an image file using steganography and extracted only at runtime—nothing is written to disk that a traditional antivirus would recognize as a threat. The result is the silent exfiltration of saved browser passwords, email login credentials, and cryptocurrency wallet contents to an attacker-controlled server.
Why This Campaign Is Particularly Insidious
A combination of three factors makes this campaign a particularly effective threat.
- First, hosting on Google Sites. The sites.google.com domain is trusted, and most organizations do not block it by default—users instinctively trust it.
- Second, in-memory execution. Since the entire attack takes place in memory and does not create traditional file-based artifacts, security operations teams are left with minimal forensic traces after an incident.
- Third, steganography. Hiding shellcode in image files reduces the number of detectable artifacts and allows the attack to bypass file-analysis tools.
Meanwhile, network communication appears as standard PowerShell activity—without behavioral detection, it is virtually invisible.
Who Is at Risk
Developers and IT professionals are the primary targets—they are accustomed to running commands according to installation guides and are less likely to question instructions on a website that looks professional. It is precisely this trust that forms the foundation of the entire attack.
What to do
Always verify installation instructions for any tool exclusively through the official documentation or the project’s original GitHub repository—not through search results. Any website prompting you to copy and paste a command should be considered suspicious, no matter how legitimate it appears.
From a technical standpoint, it is crucial to deploy an EDR solution with behavioral analysis of PowerShell activity, as traditional antivirus tools do not detect this type of attack. It is also recommended to educate development and IT teams specifically about ClickFix techniques, the prevalence of which has been growing significantly in recent months.
