Fake Claude Download Ad Uses Bing Redirect, Then Swaps the Copied Install Command
Push Security traced a Google ad through Bing and a compromised website to a fake Claude installer whose Copy button supplied a malicious command.
A trusted-looking route to a fake installer
Push Security says it found a malicious Google search ad targeting “claude mac” whose displayed destination was Bing, not an obvious Claude lookalike. The researchers traced the click through Bing’s normal search-result redirect, then a compromised retailer’s website, before it reached a fake Claude download page. Their October 9 investigation calls the layered redirect and cloaking technique “Adception.” BleepingComputer separately reported the same research, and the incident drew an English Hacker News discussion on October 10.
The fake page displayed Anthropic’s legitimate terminal installation command. Push Security found that its Copy button instead put a different command on the clipboard: it decoded a hidden attacker-controlled URL, fetched a script and piped it to the macOS shell. The terminal output was designed to show the official Claude URL, making a quick visual check misleading. The researchers said direct visits and some scanners were diverted away from the payload page, which helps explain why the ad’s Bing destination could appear benign.
What remains unknown
The reviewed reports do not identify the final script’s payload or establish how many people ran it. They document a delivery chain and deceptive installer interaction, not confirmed infections or account theft. The original research dates to October 9; this story covers that disclosure and its subsequent discussion rather than suggesting a new attack began October 12.