Attackers are impersonating popular developer tools like Claude Code to distribute fake install instructions via malicious search engine ads.