Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers use Google Ads and Bing redirects to deliver fake Claude installers with ClickFix attacks.
Attackers are leveraging Google Ads and Bing redirects to distribute a malware known as ClickFix, disguised as legitimate Claude installers for macOS. This technique, dubbed 'Adception,' uses Bing's trusted domain and compromised websites to bypass security checks, ultimately tricking users into executing malicious commands via a fake Claude installation process.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Google Ads?
Get an email when a new story names Google Ads, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers are exploiting user trust in well-known AI brands and reputable ad platforms (Google Ads, Bing) to deliver malware disguised as legitimate Claude AI installers — a technique called 'Adception.' By routing victims through Bing's trusted domain and compromised sites, attackers bypass standard security filters and trick users into manually executing malicious commands. This highlights a critical gap in security awareness: users rarely scrutinize download sources when the software appears to come from a trusted brand or familiar platform. The ClickFix method is particularly dangerous because it shifts the execution burden to the victim, making traditional endpoint defenses less effective. Organizations that fail to train employees to verify software sources and restrict unapproved software installation remain highly vulnerable to this style of social engineering.
What helps against this
How we list vendors- DNS filtering and secure web gateway
Users cannot reach known-malicious sites, and malware cannot phone home.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — claude-desk-code[.]com
- domain — lake-90[.]com