Hackers Abuse Google Ads and Bing to Push Fake Claude
Threat actors are combining Google Ads with legitimate Bing search-result redirects to deceive users searching for macOS Claude downloads into executing malicious commands.
Radwan AbdulhadiEditor and technology writer
The 'Adception' Malvertising Campaign
Threat actors have developed a sophisticated new malvertising technique that abuses legitimate Bing search-result redirects as click URLs within Google search ads. According to a report published by [Push Security](http://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results), this approach—dubbed 'Adception'—is specifically engineered to evade traditional advertising security checks.
The campaign was uncovered after security researchers detected a malicious Google advertisement targeting individuals searching for 'claude mac'. Unlike typical malvertising operations that route victims straight to attacker-controlled domains, the sponsored search result displayed the trusted bing.com domain, significantly reducing user suspicion.
How the Redirect Chain Operates
When a user clicks on the deceptive advertisement, the traffic passes through Google's advertising redirect before landing on Bing's bing.com/ck/a click-tracking endpoint. This endpoint subsequently forwards the browser to a legitimate but compromised WordPress website belonging to a South American retailer.
Bing's click-tracking redirects rely on JavaScript to dispatch visitors to their final destination. This mechanism enables attackers to route users toward malicious destinations while making the inbound traffic appear as though it originated directly from Bing.
Multi-Layered Cloaking Mechanisms
Before presenting any malicious content, the campaign utilizes multiple layers of cloaking designed to obstruct security scanners and casual visitors. The compromised WordPress website checks for a valid Bing referrer and specific browser headers before proceeding with any redirection.
Furthermore, the ultimate fake Claude destination page employs JavaScript to verify that visitors successfully arrived from either Google or inquisitive search pathways like Bing. Visitors who attempt to access the malicious URL directly are immediately redirected to a standard 404 error page, compounding the difficulty for automated security scanners attempting to analyze the threat.
The Fake Claude Installer and Clipboard Swap
The campaign's destination page closely mimics a legitimate Claude download portal, providing instructions for a macOS installer that requires execution inside the Terminal. Although the page text visibly displays Anthropic's genuine installation command—curl -fsSL https://claude.ai/install.sh | bash—interacting with the page's copy button places a completely different command onto the clipboard.
The substituted command deceptively prints a message implying it is downloading Claude from Anthropic's official repository, but it actually decodes a Base64-encoded URL pointing to lake-90[.]com. The script then uses curl to silently download a .dat file from the server controlled by the attacker and pipes its contents directly into the macOS Z shell (zsh) for execution.
Because the terminal window reflects the appearance of the official installation URL, victims remain unaware that an entirely different background script is executing. Security researchers note that the final payload delivered by this specific attack remains unidentified, meaning the precise malware installed is not yet clear.
Broader Context on ClickFix and AI Targeting
Push Security stated that it identified multiple infrastructure domains linked to this exact ClickFix toolkit, which is tracked internally under the name AcSig. These related domains share identical macOS installation commands, payload URL structures, and user interface designs.
The campaign highlights a wider industry trend where threat actors weaponize trusted AI platforms and associated search terms to deploy malicious payloads. Previous incidents analyzed by security analysts include [Custom ChatGPTs push ClickFix attacks to deploy RAT malware](https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/) and broader trends regarding [How Threat Actors Are Turning Trusted AI Platforms Into an Attack Surface](https://www.bleepingcomputer.com/news/security/how-threat-actors-are-turning-trusted-ai-platforms-into-an-attack-surface/).
Sources
- BleepingComputerHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Continue chronologically
Related entity coverage
Related stories
Anthropic Files S-1 Prospectus for Nasdaq IPO
Anthropic has filed its S-1 prospectus with the SEC to list on Nasdaq under the ticker ANT, detailing financials, risks, and compute deals.
Anthropic AI sends false homicide tip to Philadelphia police
An Anthropic AI model submitted a false tip about an unsolved Philadelphia homicide through an online tipline during testing, sparking security concerns.
ClickFix Attacks Surge Using AI Tools and Chatbots as Lures
ClickFix attacks are surging dramatically, utilizing fake AI installers and trusted chatbot platforms to trick users into executing malware.
New VOLTA Windows Malware Uses Claude to Rank Victims
Cisco Talos uncovers VOLTA, a self-deleting Windows infostealer that leverages Anthropic's Claude to rank stolen victim assets by monetization value.
