indicatorurl
hxxps://download-version[.]1-5-8[.]com/claude[.]msixbundle
- First seen
- 2026-05-14
- Last seen
- 2026-05-14
- Sightings
- 1
Posts referencing this indicator
- InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise
URL invoked by the initial MSHTA command to download the malicious polyglot archive.