[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fVjsgCxCcm4BhoaXJNhgc8P0he5jnFW7s6xvAqUM7H38":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"1b75a813-79fb-4495-9a05-95a84a306595","Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks","hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks-944cba","Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. [...]","Attackers are leveraging Google Ads and Bing redirects to distribute a malware known as ClickFix, disguised as legitimate Claude installers for macOS. This technique, dubbed 'Adception,' uses Bing's trusted domain and compromised websites to bypass security checks, ultimately tricking users into executing malicious commands via a fake Claude installation process.","Hackers use Google Ads and Bing redirects to deliver fake Claude installers with ClickFix attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fhackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F05\u002F07\u002FClaudeChats.png","2026-10-09T20:31:37+00:00","2026-10-09T22:00:07.797731+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"Google Ads","product",{"name":21,"type":19},"Bing",{"name":23,"type":19},"Claude",{"name":25,"type":26},"macOS","technology",{"name":28,"type":19},"WordPress",{"name":30,"type":31},"ClickFix","threat_actor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"domain","claude-desk-code[.]com","Fake Claude download page domain",{"type":57,"value":61,"context":62},"lake-90[.]com","Attacker-controlled server domain for payload download",[18,21,23],{"controls":65,"vendors":147},[66,93,122],{"slug":67,"name":68,"problem":69,"products":70},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[71,79,85],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-internet-access","Zscaler Internet Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-internet-access","Cloud secure web gateway with DNS security, inspection and data protection.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":80,"product_name":81,"url":83,"description":84},"dnsfilter","DNSFilter","\u002Fvendor-logos\u002Fdnsfilter.png","https:\u002F\u002Fwww.dnsfilter.com\u002F","DNS filtering for offices and roaming devices.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",{"slug":94,"name":95,"problem":96,"products":97},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"slug":123,"name":124,"problem":125,"products":126},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[127,134,141],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":131,"url":132,"description":133},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":123,"product_name":138,"url":139,"description":140},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":142,"product_name":143,"url":145,"description":146},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":163},"fake-claude-ai-ads-trick-users-into-running-malware-via-clickfix","Fake Claude AI Ads Trick Users into Running Malware via ClickFix","Attackers are exploiting user trust in well-known AI brands and reputable ad platforms (Google Ads, Bing) to deliver malware disguised as legitimate Claude AI installers — a technique called 'Adception.' By routing victims through Bing's trusted domain and compromised sites, attackers bypass standard security filters and trick users into manually executing malicious commands. This highlights a critical gap in security awareness: users rarely scrutinize download sources when the software appears to come from a trusted brand or familiar platform. The ClickFix method is particularly dangerous because it shifts the execution burden to the victim, making traditional endpoint defenses less effective. Organizations that fail to train employees to verify software sources and restrict unapproved software installation remain highly vulnerable to this style of social engineering.",[153,154,155,156,157,158,159,160,161,162],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality (restrict unauthorized software)","NIST CSF PR.AT-1: Awareness and Training","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1036: Masquerading","GDPR Article 32: Security of Processing (for organizations handling EU data)",{}]