{"slug": "adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac", "title": "\"Adception\": Google search ads route through Bing to a fake Claude for Mac installer", "summary": "Push Security detected a malvertising campaign it calls \"Adception\" in which Google search ads for \"claude mac\" route users through a genuine Bing search result and a compromised retailer's \"about us\" page to a fake Claude for Mac download page at claude-desk-code[.]com. The fake page's Copy button places a malicious terminal command on the clipboard instead of Anthropic's real install command, which when pasted decodes a hidden URL and pipes a script from lake-90[.]com into the shell; Push says 4 in 5 ClickFix attacks it detects reach victims through search engines. Push reported no earlier public record of a search result being used as a search ad's destination, and lists the Google ad campaign ID gad_campaignid=24303361122 among indicators of compromise that it warns rotate quickly.", "body_md": "[Back to News](https://ministryofcyberaffairs.com/)\n\n[Cybersecurity](https://ministryofcyberaffairs.com/category/cybersecurity)website\n\n# \"Adception\": Google search ads route through Bing to a fake Claude for Mac installer\n\nAttackers are running Google search ads for \"claude mac\" whose destination is a genuine Bing search result. The chain passes through a compromised retail site to a fake Claude download page that copies a malicious terminal command to the clipboard. Push Security calls the technique \"Adception\": it slips past Google's ad review and link scanners by showing them only trusted domains, and serves the payload only to victims who arrive through the exact path.\n\nA new malvertising campaign is abusing one search engine to hide inside another.\n\nPush Security has detected Google search ads for \"claude mac\" that send users through a real Bing search result to a fake download page for Anthropic's Claude AI app.\n\nPush has named the technique \"Adception.\"\n\n## How the chain works\n\nThe sponsored Google result showed bing.com as its domain, not a Claude lookalike.\n\nClicking it triggered four steps:\n\n- **Google's ad-click redirect** (google.com/aclk)\n- **Bing's own search-result redirect** (bing.com/ck/a), which forwards the browser with JavaScript and passes on a bing.com referrer\n- **A compromised but genuine retailer's \"about us\" page** , which forwards only visitors arriving from Bing\n- **The fake Claude page** at claude-desk-code[.]com\n\nBecause the ad's destination was simply another search engine, Google's ad review approved it.\n\nThe attacker had taken a real, indexed Bing result for a page they had compromised and placed it inside the Google ad.\n\n## Two layers of cloaking\n\nThe compromised site checks for a Bing referrer and specific browser headers before forwarding anyone.\n\nThe fake Claude page then runs a second check in JavaScript: any visitor whose referrer isn't Google or Bing is sent to a 404 page.\n\nSecurity scanners, ad reviewers and researchers visiting the URL directly see nothing malicious.\n\n## The clipboard trick\n\nThe final page is a polished copy of Claude's download page, with a \"Download for macOS\" button and a one-line terminal install.\n\nThis is the \"InstallFix\" variant of the ClickFix social-engineering technique, in which victims are tricked into pasting and running commands themselves.\n\nThe page displays Anthropic's real install command, but its Copy button puts a different command on the clipboard.\n\nWhen pasted into Terminal, it prints \"Downloading Claude: https://claude.ai/install.sh\" to reassure the user, then quietly decodes a hidden URL and pipes a script from lake-90[.]com into the shell.\n\nPush links the domains to a ClickFix toolkit it tracks as \"AcSig.\"\n\n## Why it matters\n\nRedirects through trusted domains are an old evasion trick: Google, Microsoft, LinkedIn and email security link-wrapping services have all been abused this way.\n\nBut Push says it found no earlier public report of a search result being used as a search ad's destination.\n\nPush data shows 4 in 5 ClickFix attacks it detects reach victims through search engines.\n\nAI tools are now a favourite lure, because users searching for apps like Claude, ChatGPT and coding assistants are often developers with high-value access.\n\n## Indicators of compromise\n\nPush warns that these domains rotate quickly, so IoCs have limited value on their own:\n\n- **Google ad campaign ID:** gad_campaignid=24303361122\n- **Lure and delivery domains:** claude-desk-code[.]com, ksmgakajgpsals.pages[.]dev, rapid-craft567[.]com, too.clawddddd[.]com, fine-byte2[.]com, fairpoint29[.]com, turbowave45[.]com, cli-desktop[.]com\n- **Redirect:** homeopatiaalemana[.]com/quienes-somos/\n- **Payload:** lake-90[.]com/curl/inhgup9a/a90fkbqdg8d0mus64oh8dw.dat\n\n## What users and defenders should do\n\n- Download AI apps only from the vendor's official site, typed directly or bookmarked, never from a sponsored search result\n- Never paste terminal commands copied from a web page without reading what was actually copied\n- Treat any \"install\" page that asks you to run a command in Terminal or PowerShell as suspicious\n- Block the listed domains and monitor for shell commands that decode base64 URLs and pipe them into curl\n- Use browser-level security controls that inspect the full redirect chain and clipboard activity, not just the first URL", "url": "https://wpnews.pro/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac", "canonical_source": "https://ministryofcyberaffairs.com/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac-installer-35fd034d-799e-4be3-87e2-d0b55c66f946?utm_source=rss&utm_medium=feed", "published_at": "2026-10-10 16:50:53+00:00", "updated_at": "2026-10-10 17:18:19.381226+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-products"], "entities": ["Push Security", "Google", "Bing", "Anthropic", "Claude", "Microsoft", "LinkedIn", "ClickFix"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac", "markdown": "https://wpnews.pro/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac.md", "text": "https://wpnews.pro/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac.txt", "jsonld": "https://wpnews.pro/news/adception-google-search-ads-route-through-bing-to-a-fake-claude-for-mac.jsonld"}}