A newly discovered InstallFix campaign relies on malicious commands on cloned installation webpages to trick victims into installing malware.