I'm cheating on one of these, but hopefully my explanation makes sense.
Dubbed InstallFix by Push Security, the scheme inserts instructions to download malware during the Claude Code install process on cloned websites.