Fake Claude installer ad campaign

Push Security reported an ad shown for a Google search for “claude mac” that displayed Bing as its destination. The researchers traced the click through a Bing search-result redirect and a compromised retailer’s website to a fake Claude download page. On that page, the visible installation command was legitimate, but the Copy button placed a different command on the clipboard to fetch and run an attacker-hosted script.

The original English investigation was published October 9 and drew an English Hacker News discussion on October 10. BleepingComputer also reported the chain. The final script’s payload remains unknown in the reviewed reports, and they do not establish how many people executed it or whether any account was compromised.