Claude ClickFix Attacks Abuse Google Ads and Bing Redirects

Attackers are using Google search advertisements and legitimate Bing redirects to lure Mac users into Claude ClickFix attacks. The campaign leads visitors to a fake download page that secretly replaces a displayed installation command with a malicious one.

Push Security uncovered the activity while investigating a Google advertisement aimed at people searching for “claude mac.” Researchers named the technique “Adception” because it uses one search engine’s redirect infrastructure inside another’s advertising system.

The final payload remains unknown. Researchers therefore have not established what malware, if any, the command ultimately installs.

Trusted Search Domains Conceal the Route to a Fake Installer

The malicious advertisement displayed bing.com as its destination, giving users a familiar domain instead of an obvious attacker-controlled address.

However, clicking the sponsored result started a redirect chain. Visitors first passed through Google’s advertising infrastructure and then reached Bing’s legitimate click-tracking endpoint.

From there, Bing forwarded the browser to a compromised WordPress website belonging to a South American retailer. That site then redirected eligible visitors to a fraudulent Claude download page.

The technique appears intended to evade advertising security checks by placing a trusted domain at the start of the journey. Meanwhile, the compromised retail website acts as an intermediate step before the malicious destination.

Cloaking Checks Hide the Page From Unwanted Visitors

The attackers also use two screening layers to control who sees the fake installer.

First, the compromised WordPress site checks whether visitors arrived through Bing and whether their browser headers meet specific conditions. Only qualifying traffic continues through the attack chain.

Next, the fake Claude page uses JavaScript to check whether visitors arrived from Google or Bing.

People who open the malicious address directly instead land on a 404 error page. Consequently, a security scanner visiting the address outside the expected route may fail to see the attack.

These checks help conceal the malicious content while preserving access for users who follow the advertisement.

Copy Button Substitutes a Hidden Malicious Command

The fake download page imitates a Claude installer and tells macOS users to complete installation through Terminal.

Although the page displays a legitimate Anthropic installation command, its copy button places a different command on the clipboard. Users who trust the visible instructions may therefore paste and execute something they never intended to run.

The substituted command prints a message suggesting it is downloading Claude from Anthropic’s official website. Behind that reassuring output, however, it decodes an encoded address for an attacker-controlled server.

It then retrieves a remote file and passes its contents directly to the macOS Z shell for execution.

As a result, both the webpage and the Terminal output can show references to the legitimate Claude website while an unrelated script runs.

Related Domains Point to a Shared ClickFix Toolkit

Push Security identified several domains associated with the same toolkit, which it tracks internally as AcSig.

Those sites share the same macOS installation command, a matching payload URL structure and an identical installer interface. These similarities connect the observed pages to a common set of attack components.

The Claude ClickFix attacks rely on persuading users to execute commands themselves. The trusted search domains, convincing download page and misleading copy button all support that deception.

However, the investigation has not identified the final payload. Claims that this specific campaign installs a particular information stealer or other malware would go beyond the available findings.