Cybersecurity researchers have uncovered a new malware distribution campaign in which attackers impersonate legitimate command-line installation guides for developer tools. The campaign uses a technique known as InstallFix, a variant of the ClickFix social engineering method, to trick users into executing malicious commands directly in their terminal.

The operation targets developers and technically inclined users by cloning legitimate command-line interface (CLI) installation pages and inserting malicious commands disguised as official setup instructions. Victims who follow the instructions unknowingly install the Amatera information stealer, a malware strain designed to harvest credentials and sensitive system data.