Security Firm Exposes 'Adception' Scam Using Google and Bing to Distribute Malicious Claude Installer
Security researchers at Push Security identified a sophisticated malware campaign targeting Mac users searching for the Claude AI assistant. The attack, dubbed 'Adception,' uses paid Google ads that redirect through legitimate Bing tracking services to a compromised website, eventually landing users on a fake download page. The scam employs cloaking techniques to evade security scanners and displays a benign installation command while secretly copying a malicious Base64-encoded script to the clipboard. This script, when executed in the Mac Terminal, downloads and runs remote code from an attacker-controlled server. Google has suspended the advertiser accounts involved, while Microsoft confirmed its defenses detect the threat. Anthropic did not respond to requests for comment.
Key points
- Push Security discovered a multi-step attack chain starting with a sponsored Google ad for 'Claude Mac' that redirects through Bing to a compromised South American retailer's site, then to a fake download page at claude-desk-code[.]com.
- The fake page uses 'cloaking' to show a 404 error to security scanners but displays a convincing installer to victims arriving via Google or Bing, making automated detection difficult.
- The scam employs an 'InstallFix' technique where the visible command appears legitimate, but the 'Copy' button places a different, Base64-encoded command on the clipboard that executes a remote script in the Z shell.
- Google confirmed it suspended the advertiser accounts responsible for the campaign, stating that using ads to distribute malware violates its policies and that it is updating detection systems to counter cloaking tactics.
- Microsoft stated that its Defender protections detect and block the malicious indicators identified in the report, while Anthropic did not provide a response before the publication deadline.
Background
This incident follows a series of recent campaigns exploiting trusted platforms for malware distribution. In September 2026, Netskope identified Google Ads being used to deliver browser-locking scams, and in October 2026, a fraudulent Chrome app accumulated 100,000 downloads on the Play Store before removal. Additionally, in early October 2026, Huntress reported malicious Custom GPTs on the legitimate chatgpt.com domain that lured users into installing remote access trojans via PowerShell commands. These events highlight a growing trend of attackers abusing reputable search engines and AI platforms to bypass user skepticism and security filters.
Why it matters
The campaign demonstrates how attackers are leveraging the trust associated with major tech brands like Google and Microsoft to bypass traditional security measures. By using legitimate ad platforms and search engines as entry points, the scam makes it difficult for users to distinguish between official software and malicious payloads. The use of cloaking and clipboard substitution techniques specifically targets automated security scanners and user vigilance, creating a high risk of successful infection for Mac users who rely on search engines for software downloads.
What to watch
Google has suspended the specific advertiser accounts linked to this campaign and is updating its detection systems to better identify cloaking techniques. Microsoft has confirmed its existing protections are active against the identified indicators. Users are advised to download software only from official developer websites, verify clipboard contents before executing terminal commands, and monitor their systems for suspicious activity if they have interacted with similar ads.
Want the full story? Read the original reporting
Read on Fox News