The Ad Said Bing: How a Fake Claude Installer Reached Mac Users

The Ad Said Bing: How a Fake Claude Installer Reached Mac Users

A sponsored result for "claude mac" was a trap

Security researchers at Push Security have detailed a malvertising chain aimed at Mac users. Someone searching Google for "claude mac" was served a sponsored result that ended at a counterfeit Claude download page offering a "macOS installer" — in practice, a prompt to paste a command into Terminal. The researchers have dubbed the technique "Adception," and BleepingComputer, Fox News and CyberGuy have all covered it.

The ad showed bing.com, then took four hops

The strangest detail was the address displayed in the ad: bing.com. According to BleepingComputer, a click first passes through Google's advertising redirect, then Bing's legitimate click-tracking endpoint, then a compromised WordPress site belonging to a South American retailer, and only then reaches claude-desk-code[.]com, the fake download page. Borrowing Microsoft's domain lent the ad trust and helped it clear ad review.

The page showed the real command, the copy button swapped it

The fake page displays Anthropic's genuine one-line installer, curl -fsSL https://claude.ai/install.sh | bash. Pressing the copy button, however, puts something else on the clipboard: it prints a reassuring "downloading Claude" message, decodes a Base64 string pointing to lake-90[.]com, fetches a script with curl and pipes it straight into macOS's zsh. The text on screen is honest; what runs is not. The trade name for this trick is ClickFix.

What the payload goes after

Info-stealers are the usual payload. MacSync, documented by Help Net Security among others, harvests browser history, cookies, saved passwords, crypto wallet extension data, Telegram data, the Keychain file, and developer credentials including SSH, AWS, Kubernetes and Git configuration plus shell history. For a developer, one bad paste can hand over the identity of the whole machine.

Google suspended the accounts; Microsoft points to Defender

Google confirmed to CyberGuy that it had acted: "We've suspended the advertiser accounts running the reported campaign. Using ads to distribute malware is an egregious violation of our policies, and we consistently update our detection systems to stay ahead of bad actors' evolving tactics." The company acknowledged that attackers use cloaking to show its review systems different content from what users see. Microsoft said Defender detects and blocks the malicious indicators in the report.

The same playbook ran for three months

Island tracked a parallel campaign from May to August 2026: roughly 850 paid ad landings, 26 lookalike ChatGPT destinations and 71 Google Ads campaign IDs, per Tom's Guide and Cybernews. Those ads sent "chatgpt" searchers to an attacker-built Custom GPT hosted on the real chatgpt.com, then to a fake Cloudflare check that pushed a PowerShell command and NetSupport RAT on Windows. Huntress described a similar chain under the name "Plus 5.6" in a September 28 report.

Fake "AI ad tools" target the people who buy ads

A second thread goes after money directly. Island's October 6 disclosure described a human-operated phishing platform impersonating ChatGPT, Gemini, Claude, Perplexity and Manus advertising products, luring ad staff with weekly ad briefs, manager-account support and spend audits. The "Connect" button opens a sign-in window drawn inside the page, address bar included; credentials and one-time codes are relayed to an operator in real time. Island counted more than 100 phishing domains and hundreds of victim submissions, and a fake "Muse Ads" page appeared eight days after Meta announced Muse.

Search has become the front door for malware

Push Security's detection data shows four in five ClickFix payloads it intercepted in 2026 arrived through search engines rather than email, sidestepping mail-gateway defenses entirely. The same dataset, relayed by WindowsForum, puts ClickFix at 52% of Push detections in the second quarter and 67% in August.

Install AI tools without the ad

Change the route rather than trusting your instincts: reach Claude, ChatGPT and the rest through their official sites, never through an ad; use the three-dot menu to check who paid for an ad and their verification status, or look the advertiser up in Google's Ads Transparency Center; if a page tells you to paste a command into Terminal, PowerShell or the Run box, paste it into a text editor first and read it, and stop at Base64, openssl base64 -d, mshta, or any domain that isn't the vendor's; report suspicious ads from that same three-dot menu.

Infrastructure rotates faster than blocklists

Push Security warns that indicators from this kind of campaign expire quickly, and the domains, redirect pages and payload paths it published will keep rotating. On the platform side, Google says it continues to monitor evasion, while advertiser verification and substantive checks on landing domains remain the gap that keeps these campaigns coming back.