5 minNews
Hackers Use Google Ads and Bing Redirects to Spread Fake Claude Installer
Security researchers at Push Security have uncovered a scheme that hides a malicious fake Claude download behind sponsored Google search results and legitimate Bing redirect links, using a clipboard-swapping trick to get Mac users to run dangerous commands.
Security researchers have uncovered a scheme that uses sponsored Google search results and legitimate Bing redirect links to steer Mac users toward a fake Claude download page, where a clipboard-swapping trick tricks them into running a malicious command. The technique, which the researchers at Push Security jokingly call «Adception,» exploits how advertising systems and search-engine redirects interact to make a dangerous destination appear trustworthy.
The attack begins when someone searches Google for «Claude Mac,» looking for the popular AI assistant made by Anthropic. A sponsored result appears, and its displayed destination is, the domain of Microsoft's search engine. That address can seem reassuring because Bing belongs to Microsoft. Clicking the advertisement, however, sends the browser through a chain of redirects rather than to Bing itself.
First, Google's advertising system processes the click. Next, Bing's legitimate click-tracking service forwards the browser to a compromised WordPress website belonging to a South American retailer. That site then sends the visitor to a fake Claude download page at claude-desk-code[.]com, which imitates the real Claude download experience and presents what appears to be a legitimate macOS installation option. By the time a user arrives, the journey began with a malicious advertisement may be far from obvious.
Researchers say the attackers deliberately used a real Bing search result for a compromised website. That allowed them to display Bing's legitimate domain in the Google advertisement while using Bing's click-tracking redirect to move visitors toward the malicious destination. The compromised retailer's site checks whether visitors arrived through Bing and whether their browsers send certain information, while the fake Claude site checks whether visitors came from Google or Bing. Someone who reaches the malicious site directly may see a 404 error page instead of the fake installer, a practice known as cloaking that can frustrate security scanners investigating the campaign.
The deception becomes more pointed on the fake download page. It displays an installation command that appears to come directly from Anthropic and references Claude's legitimate website, looking like something a technically confident Mac user might recognize. But the page's Copy button places a different command on the clipboard. According to Push Security, the substituted command uses Base64 encoding to conceal an attacker-controlled website.
When someone runs the pasted command in Mac Terminal, it first displays a reassuring message claiming that Claude is being downloaded from its official website. Behind the scenes, the command decodes the hidden address, downloads a remote script and sends it directly to the Mac's Z shell for execution. The person running the command sees references to Claude's legitimate website even though the Mac is executing code from an unrelated server.
The campaign follows a technique known as InstallFix, a variation of ClickFix, in which scams convince people to execute malicious commands themselves, often by disguising the instructions as a software installation or troubleshooting step. Push Security identified several additional websites associated with the same malicious toolkit, which it tracks internally as AcSig, and found matching installation commands and similar fake installer interfaces across those sites.
The research confirms that the malicious command is designed to download a remote script from an attacker-controlled server and pass it directly to the Mac's Z shell. However, Push Security's published findings do not identify the final payload or establish what the downloaded script does after execution. That uncertainty matters: running an untrusted Terminal command can give malicious code an opportunity to operate with the permissions of the person executing it. Depending on the script, an attacker could potentially steal information, modify files or install additional software, though the researchers have not confirmed those specific outcomes in this campaign.
The broader concern is how easily the attack persuades people to bypass their own caution. The user voluntarily pastes and runs the command, and the layered use of legitimate advertising and search infrastructure makes the path to the fake installer difficult to spot. The case underscores that sponsored search results and familiar domains are not by themselves proof of legitimacy, particularly when a download page asks users to copy and execute commands in a terminal.
4
