Push Security describes the "Adception" campaign: a Google ad showing a Bing domain leads to a fake Claude installer with a malicious command
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
The popularity of SI apps attracts scammers: install them only from official pages and do not paste someone else's commands into a terminal.
According to Push Security, Google ads for queries like "claude mac" displayed the address bing.com, and a chain of redirects through a Bing tracking link led to a hijacked retailer's website and then to a fake Claude installation page (claude-desk-code.com). The "copy" button there put a hidden Base64 command on the clipboard instead of the real install command; it downloaded and ran a script from the attackers' server, and two layers of referrer checks hampered detection. The company ties the "ClickFix" technique to a toolkit called AcSig; by its data, 4 in 5 such attacks reach victims through search engines.
Sources 2