Skip to content

Back to the catalog

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
bleepingcomputer.comarticle

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

BleepingComputer covers Push Security's "Adception" technique: Google search ads for "claude mac" use a bing.com/ck/a click-tracking redirect via a compromised WordPress retailer site to reach fake Claude download page claude-desk-code[.]com. The page shows Anthropic's real install command but the copy button swaps in a Base64-obfuscated curl | zsh command fetching a .dat payload from lake-90[.]com. Multi-layer referrer/header cloaking defeats scanners and direct visits; the toolkit is tracked as AcSig and the final payload is unknown.

TL;DR Google ads abusing Bing click redirects push fake Claude macOS installers that use ClickFix clipboard hijacking to run a curl|zsh payload.
Open original ↗

Organisations named here

  • Adception
  • claude-desk-code[.]com
  • ClickFix
  • lake-90[.]com

Technologies named here

  • Push Security
  • macOS users
  • Malicious domains
  • curl and Base64 decoding piped into zsh
  • Google Ads
  • Bing search redirects
  • WordPress website of a South American retailer
  • macOS Z shell used to execute the payload
  • Claude
  • Bing
  • macOS
  • WordPress
  • Zsh

Techniques named here

  • Malvertising
  • Redirect chain
  • ClickFix
  • Compromised legitimate website abused as redirector

Threat actors named here

  • Adception
  • AcSig
  • ClickFix attacks; final payload unknown

Related in Threat Intel