Searching for "claude mac" and clicking the first ad could land you on a fake Claude installer that runs attacker code on your Mac. Security researchers at Push Security have documented a malvertising technique they call "Adception," which hides behind Bing's trusted domain inside Google search ads. If you are setting up AI coding tools like Claude Code, this one is worth knowing about.
Here is how the attack works, what it does to your clipboard, and how to avoid it.
What Researchers Found
Push Security spotted a malicious Google ad aimed at people searching for "claude mac." Most malvertising points to an attacker-owned domain. This ad instead displayed the legitimate bing.com domain, which makes it look less suspicious and appears designed to slip past advertising security checks.
- Technique name: "Adception," abusing a search engine's own redirects inside another search engine's ads.
- Target: macOS users looking for Claude.
- Attack type: ClickFix, which tricks victims into running a command themselves.
- Final payload: Unknown. Researchers have not identified what malware, if any, is installed.
The Redirect Chain
| Step | What Happens |
|---|---|
| 1. Google ad | The sponsored result shows the bing.com domain and passes through Google's ad redirect |
| 2. Bing click tracker | Bing's click-tracking endpoint forwards the browser using JavaScript, so the traffic looks like it came from Bing |
| 3. Compromised site | A hacked WordPress site belonging to a South American retailer checks the referrer and browser headers, then redirects |
| 4. Fake download page | claude-desk-code[.]com imitates Claude's download page and offers a macOS install command |
Two layers of cloaking protect the payload. The compromised site checks for a Bing referrer, and the fake page uses JavaScript to confirm the visitor came from Google or Bing. Anyone opening the malicious URL directly gets a 404 error, which makes automated scanners and researchers less likely to see the real page.
The Clipboard Swap
The fake page displays Anthropic's real install command, curl -fsSL https://claude.ai/install.sh | bash. But when you click the copy button, a different command goes to your clipboard. According to Push Security, that command:
- Prints a message claiming it is downloading Claude from Anthropic's official site.
- Decodes a Base64-encoded URL that points to lake-90[.]com.
- Silently downloads a .dat file with curl and pipes it straight into the macOS Z shell (zsh) to run.
How to Stay Safe
These steps are TechFixGrid's general security advice, not instructions from Push Security:
- Skip the ads: Type the vendor's address into your browser yourself, or use a bookmark. Do not click sponsored results for software downloads.
- Check the address bar: Make sure you are on the vendor's real domain before you copy anything. The fake page here used a look-alike domain.
- Inspect what you paste: Paste copied commands into a plain text editor first. If the text differs from what the page showed, or contains Base64 strings or unfamiliar URLs, do not run it.
- Be wary of "copy and paste into Terminal" prompts: This is the core ClickFix trick. A legitimate installer rarely needs you to trust a clipboard button blindly.
- If you already ran it: Disconnect from the network, change important passwords from a different, clean device, run a reputable malware scan, and contact your IT or security team. The payload is unknown, so assume exposure of saved credentials and browser sessions.
Why This Matters
Attackers are no longer just buying lookalike domains. By routing ads through a trusted search engine's redirect and a hacked third-party site, they blend into normal traffic and dodge the checks that rely on domain reputation. Pairing that with a clipboard swap defeats the habit of comparing the command on screen to the official one. Popular AI tools are an obvious lure, so expect similar campaigns against other products.
Official source: Push Security's Adception report.
Frequently Asked Questions (FAQ)
What is Adception?
It is Push Security's name for a malvertising technique that uses one search engine's trusted redirects (Bing) as the destination of ads on another (Google).
What is a ClickFix attack?
It is a social-engineering method that persuades a user to run a malicious command themselves, here by copying it from a fake page into Terminal.
What malware does the fake Claude installer deliver?
That is unknown. The script downloads and executes a remote file, but researchers have not identified the final payload.
Why does the command look legitimate?
The page shows Anthropic's real install command, but the copy button places a different one on the clipboard. The substituted command also prints a message claiming to download from the official site.
How can I download software safely?
Go directly to the vendor's official website, avoid sponsored results, and review any command before running it in Terminal.
No comments:
Post a Comment