claudecode.uk isn't where Claude Code comes from, and neither is claudecode.us. Anthropic's install commands fetch Claude Code from claude.ai, its release files and signing keys live on downloads.claude.ai, and its documentation is at code.claude.com. If a page on any other domain hands you a command to paste into your terminal, close the tab.
As of October 28, 2026, claudecode.uk shows a bare "Welcome to nginx!" page, which is the placeholder a web server displays before anyone has put a real site on it. Its registration record says it was registered on July 26, 2025. claudecode.us was registered in August 2025, lapsed in August 2026, and is now waiting to be deleted. Neither one appears anywhere in Anthropic's documentation. An empty page today also tells you nothing about what the same domain will serve next month, which is why typing a lookalike address into a search box and trusting whatever comes back is a bad habit with this tool in particular.
Fake Claude Code install pages have already been used to spread malware. In March 2026, Push Security published research on a campaign it named InstallFix. Attackers built near-identical copies of Anthropic's Claude Code install page and bought Google ads so the copies showed up first for searches like "Claude Code install" and "Claude Code CLI." Push listed copies hosted at addresses such as claude-code-install.squarespace.com, claud-code.pages.dev and claude-code-macos.com.
The copies were convincing because almost everything on them was real. The links went to Anthropic's actual site. The one thing swapped out was the install command, the single line you're told to copy and run. On a Mac, the fake command decoded a hidden web address and pulled a script from the attacker's server. On Windows, it used mshta.exe, a program that ships with Windows, to run code from claude.update-version.com. Push's write-up summed up why this works so well: "All you need to make this attack work is a popular tool you can impersonate."
The payload was an infostealer called Amatera. Malwarebytes researcher Pieter Arntz wrote that it goes after saved passwords, browser cookies, session tokens, and autofill data, and that stolen sessions can open cloud dashboards and admin panels without the victim's password. For a developer, that's the nightmare version: one pasted line, and someone else is logged into your GitHub, your hosting account, and whatever else your browser remembers.
The official ways to install Claude Code
These are the commands in Anthropic's setup docs. On macOS, Linux, or WSL, run curl -fsSL https://claude.ai/install.sh | bash.
In Windows PowerShell, run irm https://claude.ai/install.ps1 | iex. In the older Windows Command Prompt, the line is curl -fsSL https://claude.ai/install.cmd -o install.cmd && install.cmd && del install.cmd.
If you'd rather use a package manager, Homebrew users can run brew install --cask claude-code, Windows users can run winget install Anthropic.ClaudeCode, and anyone with Node.js 22 or later can run npm install -g @anthropic-ai/claude-code. Debian, Fedora, RHEL, and Alpine also get signed apt, dnf, and apk repositories, which the same docs page walks through.
Before you press Enter on any of these, look at the address inside the command. Every official one-liner fetches from claude.ai. A command that pulls from some other domain, or hides its address inside a scrambled base64 string you can't read, is the warning sign Push described. Getting to the docs by typing code.claude.com yourself is safer than clicking a search result, since the InstallFix pages arrived through sponsored results that sit above the real ones.
How to check the copy you already have
Anthropic signs its builds, so you can confirm the program on your machine came from Anthropic. On Windows, the native installer puts Claude Code at %USERPROFILE%\.local\bin\claude.exe, and running Get-AuthenticodeSignature "$env:USERPROFILE\.local\bin\claude.exe" in PowerShell should show a valid signature from "Anthropic, PBC." On a Mac, the binary is signed by "Anthropic PBC" and notarized by Apple, and codesign --verify --verbose run against it should come back clean. Linux binaries aren't individually signed, so the docs have you check a GPG-signed manifest of checksums instead, or install from the apt, dnf, or apk repositories, which check signatures for you.
If you ran an install command from a page you can't vouch for, treat that computer as compromised. From a different device, change the passwords your browser had saved, sign out of every active session on GitHub, your email, and your cloud accounts, and replace any API keys that were stored on the machine. Then wipe it or have someone who knows malware cleanup look at it. Changing passwords from the infected computer itself doesn't help much if the stealer is still running.
If you're starting from scratch, our beginner's guide to installing Claude Code goes through each operating system step by step, and our list of Claude Code error messages covers what to do when the real installer complains.
Sources
Push Security: InstallFix, how attackers are weaponizing malvertised install guides - Jacques Louw, March 6, 2026, updated March 16. The cloned Claude Code pages, Google ads targeting, lookalike and payload domains, the Mac and Windows commands, Amatera Stealer, and the impersonation quote.
Malwarebytes: Fake Claude Code install pages hit Windows and Mac users with infostealers - Pieter Arntz, March 9, 2026. What Amatera steals and how stolen sessions are used.
Help Net Security: Fake Claude Code install pages highlight rise of InstallFix attacks - Zeljka Zorz, March 9, 2026. Summary of the Push Security findings.
Claude Code docs: Set up Claude Code - Official install commands for every platform, Homebrew, WinGet, npm and Linux repositories, install paths, and the code-signing checks for macOS, Windows, and Linux.
Nominet registration record for claudecode.uk - Registration date of July 26, 2025.
Registration record for claudecode.us - Registered August 18, 2025, expired August 18, 2026, in redemption and pending delete.
