Attackers ran a Google search ad that displayed Microsoft's bing.com as its destination to steer Mac users looking for Anthropic's Claude toward a fake installer page, BleepingComputer reported Friday, citing research by security company Push Security. The campaign targets developers who install AI coding tools by pasting commands into a terminal, a group whose machines often hold source code and cloud credentials.

What Happened

In a blog post published Oct. 9, Push said it found the campaign in a customer's environment. A sponsored Google result for the search "claude mac" showed bing.com as its domain, a technique Push has nicknamed "Adception."

Push traced the path a click took. Google's ad redirect sent the browser to Bing's click-tracking address, the link Bing uses to log clicks on its own search results. That page forwarded the visitor to a hacked page on the WordPress website of a legitimate South American retailer, which in turn sent ad traffic to a fake Claude download page.

RelatedNew curl Release Fixes 24 Flaws, Including a High-Severity Bug Reported With Anthropic’s Claude

Two layers of filtering protected the lure. The hacked retailer page passed visitors along only if they arrived from Bing with certain browser details, and the fake page itself checked that the visitor came from Google or Bing. Anyone who typed the address directly got a "page not found" error, which BleepingComputer noted hampers automated scanners.

The fake page imitated Claude's macOS installation instructions and displayed Anthropic's genuine one-line install command. Its copy button, however, put a different command on the clipboard. According to BleepingComputer, that command printed a reassuring message, quietly downloaded a file from an attacker-controlled domain and ran it through zsh, the default Mac command shell. The final payload is not known.

Push said it had seen Bing's click-tracking link abused before in phishing emails and QR codes but found no earlier public report of a search ad using another search engine's result link as its destination. No statements from Google, Microsoft or Anthropic were reported.

Why It Matters

The attack belongs to a family known as ClickFix, in which the victim is persuaded to paste and run a command themselves. Because the user launches it, the command can sidestep the browser warnings and download checks that would flag a suspicious file. Many AI coding tools, including Claude's own installer, are distributed through exactly this kind of terminal one-liner, so a convincing copy of a real instruction page looks routine to a developer.

For organizations, the exposure runs through the people with the most access. A developer laptop compromised during a tool install can expose code repositories, cloud keys and internal systems. The ad also undercuts common advice to check the domain before clicking: here the visible domain belonged to a major search engine.

Push's data, which is vendor research and not independently verified, suggests the delivery route is common. The company said about four in five ClickFix attacks it detects reach victims through search engines. It linked eight lure domains to a ClickFix toolkit it tracks as AcSig, identified by a shared macOS command, payload address format and installer page code.

What to Watch

Push argued that blocking known bad domains has limited value because attackers rotate them quickly, and pointed instead to detecting malicious clipboard activity in the browser. Watch whether Google removes the ads and whether Microsoft restricts use of its click-tracking link as an ad destination, whether researchers identify what the downloaded script installs, and whether the same toolkit appears behind ads for other AI tools. Security teams can also point developers to installation commands published on vendors' own sites and treat ads for developer tools with suspicion.