A coordinated campaign leverages legitimate Bing search-result redirects as the click destination in Google ads, routing victims to counterfeit Claude installers that deliver ClickFix attacks. Security researchers at Push Security have named this approach "Adception," identifying it as a method designed to bypass ad platform security by masking the true malicious endpoint behind Bing's reputable domain before forwarding users through a compromised intermediary to the actual payload.
The attack employs multiple cloaking layers to shield the malicious content from security scanners and direct visitors. Push Security discovered the campaign after spotting a malicious Google ad targeting searches for "claude mac."
Rather than directing users to attacker-controlled domains as traditional malvertising does, the sponsored listing presented the legitimate bing.com domain, lending the advertisement credibility. Upon clicking, the ad passed through Google's advertising redirect before reaching Bing's bing.com/ck/a click-tracking endpoint, which then forwarded the browser to a legitimate but compromised WordPress site operated by a South American retailer.
From there, the compromised website redirected visitors to claude-desk-code[.]com, a fraudulent Claude download page targeting macOS users. Bing's click-tracking redirects rely on JavaScript to send visitors onward, enabling attackers to route users to malicious sites while making the traffic appear to originate from Bing.
The campaign implements two distinct cloaking mechanisms to prevent unintended access to the payload. The compromised WordPress site verifies both a Bing referrer and specific browser headers before redirecting, while the fake Claude site uses JavaScript to confirm visitors arrived from Google or Bing. Direct access attempts result in a 404 error page, complicating analysis by automated security tools.
Fake Claude installer hides malicious commands
The final destination mimics a legitimate Claude download page and presents a macOS installer via a Terminal command. Although the page displays Anthropic's genuine installation command, curl -fsSL https://claude.ai/install.sh | bash, activating the copy button places a different command into the clipboard.
The substituted command displays a message claiming to retrieve Claude from Anthropic's servers but actually decodes a Base64-encoded URL pointing to lake-90[.]com. It then silently downloads a .dat file from the attacker's server and pipes the contents directly into the macOS Z shell (zsh) for execution.
Users observe the legitimate Claude installation URL both on the download page and in the terminal, despite an entirely different script running in the background. The ultimate payload remains unidentified, leaving uncertainty about what malware, if any, gets installed.
Push Security identified multiple domains tied to the same ClickFix toolkit, tracked internally as AcSig, that share an identical macOS installation command, payload URL structure, and installer design.