Fake Claude Code Google Ads Spread Malware to Windows and macOS
Summary
Bitdefender researchers describe a malicious Google Ads campaign that led users to fake Claude Code instructions and malware: a Windows stealer and a macOS backdoor capable of remote shell access.
Key points
- A malicious sponsored ad impersonated Claude Code and directed users to a fake documentation page hosted on a Squarespace subdomain.
- The ClickFix instructions relied on victims copying and running commands; the campaign did not exploit a software vulnerability.
- On Windows, the instructions used mshta.exe to download a payload that included stealer components.
- On macOS, obfuscated Base64 commands downloaded and ran a Mach-O backdoor capable of spawning shells and executing remote commands.
- Bitdefender says the Windows payloads are detected under several Trojan names, including Trojan.Stealer.GJ and Trojan.Stealer.GK.
- Researchers believe attackers used a compromised advertiser account associated with a Malaysian company; Google has deactivated the account.
Article Details
- Attack Vectors
- A malicious Google ad impersonated Claude Code and redirected users to a fake documentation page hosted on a Squarespace subdomain.
- The fake page used ClickFix social engineering to persuade users to copy and run OS-specific installation commands.
- On Windows, the command used mshta.exe to download and execute a payload containing an HTA file and executable component.
- On macOS, an obfuscated command decoded and piped content into zsh; a subsequent script downloaded and launched a Mach-O backdoor.
- Defensive Notes
- Avoid sponsored results for software downloads and verify the domain carefully.
- Do not execute installation commands unless you understand what they do.
- Use a security solution capable of blocking these attempts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 3b4d3a59024f14cf1f07395afd6957be05d125e00ae8fdcea3a5dee1d8ab9dd3 | Hash listed by the article as an IOC for the campaign. |
| SHA256 | 505b32ac2b6fffb5fac81d5bdc2e1e8581fc4196dfb01aee852216a3ad6ff47e | Hash listed by the article as an IOC for the campaign. |
| SHA256 | 762fb099115d1917b6f673cc5c74a4b61962a64d640673aaf02566ca6a3dbfa4 | Hash listed by the article as an IOC for the campaign. |
| SHA256 | 79cd21185c51a5bfe2cfebdc51e14b258d91549fc0e4e09b6939c2a8a1c5ac19 | Hash listed by the article as an IOC for the campaign. |
| SHA256 | a78e487995ab452c5990b4baff6a4fa485ae2798c2ddd13718c17eb641f11646 | Hash listed by the article as an IOC for the campaign. |
| SHA256 | eb4d9a0e4c483dc29ae8c4d31fafcd583c457923d3344745b5c7ab13abed4dc5 | Hash listed by the article as an IOC for the campaign. |
| URL | hxxp[:]//code[.]claude[.]ai/download/ | URL displayed in the macOS command as a download lure and listed as a campaign IOC. |
| URL | hxxps[:]//claude-code-cmd[.]squarespace[.]com | Fake Claude Code documentation page used in the malicious campaign. |
| URL | hxxps[:]//download[.]active-version[.]com/claude | Attacker-used URL from which the Windows command downloads a payload. |
| URL | hxxps[:]//wriconsult[.]com/n8n/update | Attacker-used URL serving the macOS Mach-O backdoor. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe macOS script uses Base64 encoding and compression, while the backdoor uses string obfuscation and decryption routines.T1059.001 · PowerShellWindows users are instructed to run the malicious command in PowerShell.T1059.003 · Windows Command ShellWindows users are also given the malicious mshta.exe command for CMD.T1059.004 · Unix ShellThe macOS infection chain uses zsh to decode and execute scripts and launch the downloaded binary.T1105 · Ingress Tool TransferThe Windows command and macOS script retrieve payloads from attacker-used URLs.T1204.004 · Malicious Copy and PasteClickFix persuades victims to copy and execute attacker-provided installation commands.T1218.005 · MshtaThe Windows command uses mshta.exe to download and execute the payload.
People
Malware
Atomic macOS Stealer (AMOS)The macOS malware executes Anti-Sandbox/anti-VM checks similar to those of the AMOS stealer, a known macOS infostealer capable of harvesting credentials, browser data, and crypto-related information.Gen:Variant.Barys.509034Bitdefender detects the Windows payload as Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316 and Gen:Variant.Barys.509034IL:Trojan.MSILZilla.245316Bitdefender detects the Windows payload as Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316 and Gen:Variant.Barys.509034Trojan.Stealer.GJBitdefender detects the Windows payload as Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316 and Gen:Variant.Barys.509034Trojan.Stealer.GKBitdefender detects the Windows payload as Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316 and Gen:Variant.Barys.509034
Vendors
AnthropicBitdefender’s security researchers have discovered a malicious Google Ads campaign that targets anyone looking for downloads related to Claude, the large language model developed by Anthropic.BitdefenderBitdefender’s security researchers have discovered a malicious Google Ads campaign that targets anyone looking for downloads related to Claude, the large language model developed by Anthropic.GoogleWindows and macOS Malware Spreads via Fake “Claude Code” Google Ads