Hackers Use Google Ads and Bing Redirects to Deliver Fake Claude ClickFix Attack
Summary
Researchers say attackers used Google search ads, Bing redirects and a compromised WordPress site to send macOS users to a fake Claude installer that copied a malicious command to the clipboard. The final payload is unknown.
Key points
- A Google ad targeting searches for “claude mac” used a Bing click-tracking URL to route users through a compromised South American retailer’s WordPress site to a fake Claude download page.
- The attackers used referrer and browser-header checks, plus JavaScript verification, to cloak the malicious destination from direct visitors and security scanners.
- The fake installer showed Claude’s legitimate installation command, but its copy button placed a different command in the clipboard.
- That command decoded an attacker-controlled URL, downloaded a .dat file, and piped its contents into macOS zsh for execution.
- The delivered payload and whether it installs malware remain unknown; researchers linked other domains to the same ClickFix toolkit, tracked internally as AcSig.
Article Details
- Attack Vectors
- Google search ads use Bing click-tracking redirects to send users through a compromised WordPress retailer website to a fake Claude download page.
- The fake installer substitutes a malicious Terminal command for the displayed legitimate Claude installation command. The command decodes a URL, downloads a .dat file with curl, and pipes it to zsh for execution.
- Cloaking checks for a Bing referrer and browser headers, and the fake site verifies arrival from Google or Bing; direct visitors are redirected to a 404 page.
- Defensive Notes
- Treat ads and redirects using trusted domains as potentially malicious; the article describes a Bing redirect being used to reach a compromised site and a fake download page.
- Verify Terminal commands independently before executing them, especially commands copied from download pages.
- The final payload is unknown, and the article does not report what malware, if any, is installed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | claude-desk-code[.]com | Fake Claude download domain used to deliver the ClickFix command. |
| DOMAIN | lake-90[.]com | Attacker-controlled server hosting the URL from which the command downloads a .dat payload. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe command decodes a Base64-encoded URL before downloading the payload.T1059.004 · Unix ShellThe downloaded .dat file is piped to the macOS Z shell (zsh) for execution.T1105 · Ingress Tool TransferThe command uses curl to download a .dat file from lake-90[.]com.T1204.002 · Malicious FileThe attack relies on users copying and executing the substituted installation command in Terminal.
Vendors
Products
BingHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksClaudeHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksmacOSThe compromised website then redirected the visitor to claude-desk-code[.]com, a fake Claude download page designed to trick macOS users into executing malicious commands.WordPressbing.com/ck/a click-tracking endpoint, which forwarded the browser to a legitimate but compromised WordPress website belonging to a South American retailer.