A new malvertising campaign, dubbed "Adception" by security researchers at Push Security, is leveraging Google Ads and Bing redirects to distribute fake Claude installers that deploy "ClickFix" attacks. The campaign was identified after researchers observed malicious Google ads targeting users searching for "claude mac."
Unlike typical malvertising, the sponsored search results displayed the legitimate bing.com domain as the ad destination, which likely helped the ads bypass security checks and appear more trustworthy to users. When clicked, the ad first passed through Google's advertising redirect before reaching Bing's click-tracking endpoint, bing.com/ck/a. This endpoint then forwarded the browser to a compromised WordPress website belonging to a South American retailer.
The compromised WordPress site employed a multi-layered cloaking technique. It checked for a Bing referrer and specific browser headers before redirecting visitors to claude-desk-code[.]com, a fake Claude download page. The fake Claude website further verified that visitors originated from Google or Bing using JavaScript. Attempts to access the malicious site directly resulted in a 404 error, hindering analysis by automated security scanners.
The fake Claude download page is a convincing imitation, offering a macOS installer via a Terminal command. While the page displays Anthropic's legitimate installation command, `curl -fsSL https://claude.ai/install.sh | bash`, clicking the copy button places a malicious command into the clipboard.
The substituted command first prints a message claiming to download Claude from Anthropic's official website. However, it then decodes a Base64-encoded URL pointing to lake-90[.]com. This malicious script uses `curl` to silently download a `.dat` file from the attacker-controlled server and pipes its contents directly into the macOS Z shell (zsh) for execution. This sophisticated method ensures that victims see the legitimate Claude installation URL both on the download page and in their terminal, even as a different, malicious script is being executed.
The specific payload delivered by this attack remains unknown. However, Push Security has linked several domains to the same ClickFix toolkit, which they track internally as AcSig. These domains share an identical macOS installation command, payload URL structure, and installer interface, suggesting a coordinated campaign.
The use of Bing's legitimate click-tracking redirects, which employ JavaScript to send visitors to their destination, allowed attackers to make the traffic appear to originate from Bing, further enhancing the campaign's deceptive nature. This "Adception" technique highlights attackers' evolving methods to evade detection and exploit trusted platforms to distribute malware.
