GoPlus Security has issued an alert stating that attackers are promoting malware disguised as the official Claude Code installation page through Google search ads. The page is a highly realistic clone site, and once users download and install it, the malicious program could steal passwords, cookies, session tokens, crypto wallets, and system information. The security team advises users to be cautious of search results marked with "Ad" and to verify the source of the website.