Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Security researchers have uncovered a malvertising campaign that hijacks legitimate Bing search-redirect infrastructure to serve fake Claude AI installers laced with ClickFix payloads, bypassing Google's ad-policy checks in the process. The technique, named "Adception" by the team at Push Security who discovered it, was detailed in BleepingComputer's report published October 9, 2026.

This piece covers exactly how the multi-hop redirect chain works, why bing.com's trusted domain was chosen as cover, what the fake Claude page does to a visitor's clipboard, and what remains unknown about the final payload — relevant to anyone using macOS who has ever searched for AI tools through Google.

Hackers abuse Google Ads: what actually changed

Push Security researchers spotted the campaign after detecting a malicious Google ad targeting users who searched for "claude mac." What made the ad unusual was its destination domain: the sponsored result displayed the legitimate bing.com address rather than an attacker-controlled site, which made the advertisement appear far less suspicious than a typical malvertising link. Conventional malvertising campaigns route victims directly to domains the threat actor owns or controls; this one inserted Bing's click-tracking infrastructure as a trusted intermediate stop.

The domain shown in the ad — bing.com — passes visual inspection and, Push Security argues, is likely designed to pass advertising platform security checks as well. Google's ad-review systems evaluate destination URLs, so using a recognizable, high-reputation domain as the listed click target reduces the probability of the ad being flagged or rejected before it reaches users. Push Security tracks the underlying toolkit internally as AcSig and identified multiple domains associated with it that share an identical macOS installation command, payload URL structure, and installer interface.

Hackers abuse Google Ads: how it works

When a user clicked the ad, the browser passed first through Google's own advertising redirect, then landed at Bing's bing.com/ck/a click-tracking endpoint. Bing uses JavaScript at that endpoint to forward visitors onward, and in this campaign it forwarded traffic to a legitimate but compromised WordPress website belonging to a South American retailer. That retailer's site then redirected the visitor to claude-desk-code[.]com, a convincing imitation of an Anthropic download page aimed at macOS users.

Two cloaking layers protected the payload from automated analysis. The compromised WordPress site checked for a Bing referrer and specific browser headers before executing the redirect, and the fake Claude site ran JavaScript to confirm visitors arrived from Google or Bing. Anyone attempting to load the malicious URL directly — as an automated scanner typically would — was sent to a 404 error page instead, effectively hiding the attack from security tooling that inspects ad destinations by fetching them without the expected referrer chain.

Hackers abuse Google Ads: why it matters now

The Adception technique matters because it exploits the trust relationship between two major advertising and search ecosystems simultaneously. By routing through bing.com/ck/a, attackers leveraged Microsoft's own click-tracking service as an unwitting redirect layer, making the traffic appear to originate from Bing even though it ultimately led to a malicious domain. That same redirect mechanism is a routine part of Bing's search-result infrastructure, meaning defenders cannot simply block bing.com click-tracking without affecting legitimate Bing traffic.

The ClickFix payload delivery method compounds the problem. Rather than dropping a malicious file directly, the fake Claude page displayed Anthropic's real installation command — curl -fsSL https://claude.ai/install.sh | bash — in visible text on the page, giving the impression of legitimacy. When the user clicked the copy button, the clipboard silently received a different command entirely: one that decoded a Base64-encoded URL pointing to lake-90[.]com, fetched a .dat file from that attacker-controlled server, and piped the contents directly into the macOS Z shell for execution.

Hackers abuse Google Ads: who is affected

The campaign specifically targeted macOS users searching for Claude on Google. The fake installer page was engineered for macOS, the malicious clipboard command invoked zsh, and the lure was built around the Claude brand — making the primary risk population people on Apple hardware who were actively looking to install Anthropic's AI assistant. The audience of someone searching "claude mac" is likely technically comfortable enough to open Terminal and run an installation command, which is precisely the behavior the ClickFix technique exploits.

Push Security's researchers note that the final payload delivered by the attack remains unknown, so it is unclear what malware, if any, was ultimately installed on victims' machines. The campaign does fit a pattern: related ClickFix activity has previously been observed delivering remote-access trojans through fake ChatGPT installers, and a separate wave of Infinity Stealer malware used ClickFix lures to grab macOS data. The AcSig toolkit Push Security identified spans several domains, suggesting the operators have built reusable infrastructure for this class of attack rather than running a one-off campaign.

Hackers abuse Google Ads: what to watch

The attack chain Push Security documented involves at least five distinct hops — Google ad click, Google redirect, Bing click-tracking, compromised WordPress retailer, fake Claude site — each of which is designed to look legitimate in isolation. That layering makes attribution harder and interception at any single point insufficient. Defenders watching for ClickFix campaigns will need to account for the possibility that the URL displayed in a Google ad may be two or three redirects removed from the actual destination domain.

Push Security says it identified several domains associated with the AcSig toolkit beyond claude-desk-code[.]com and lake-90[.]com, all sharing the same macOS command structure and installer interface. That consistency suggests the operators are running a scalable template rather than manually crafting each lure. Anthropic separately warned earlier in 2026 that infostealer malware was hijacking Claude sessions to drain usage credits, signaling that the Claude brand has become a consistent target for threat actors looking to exploit interest in AI tooling.