Anthropic: 2 Cloaking Layers Shield Fake Claude Installers in 'Adception' ClickFix Campaign
Push Security researchers have documented "Adception," a campaign in which malicious Google ads abuse Bing's click-tracking redirect to send macOS users to fake Claude installers that swap a malicious shell command onto the clipboard. Two layers of cloaking defeat scanners, and the final payload remains unconfirmed.
Researchers at Push Security have documented a campaign, dubbed "Adception," in which malicious sponsored Google search ads display the legitimate bing.com domain as the click destination and abuse Bing's click-tracking redirect endpoint to funnel macOS users searching for "claude mac" to fake Claude download pages, according to BleepingComputer, which covered the Push Security report on October 9, 2026 at 04:31 PM. The fake pages imitate Anthropic's Claude for macOS installer and use a copy-button substitution trick to place a malicious shell command on the victim's clipboard, a ClickFix-style attack that ends with a payload downloaded and executed in the macOS Z shell.
What was the specific vulnerability?
The technique abuses Bing's click-tracking redirect endpoint, bing.com/ck/a, which allowed a sponsored Google ad to display bing.com as its visible destination while the click was actually routed through attacker-controlled infrastructure. According to Push Security's report, published on the company's blog and covered by BleepingComputer, the redirect chain ran through Google's advertising redirect, then Bing's click-tracking endpoint, then a compromised WordPress site belonging to a South American retailer, before landing on the fake Claude download page claude-desk-code[.]com.
The fake page imitates Anthropic's Claude for macOS installation flow. It displays Anthropic's legitimate install command, "curl -fsSL claude.ai | bash", but the copy button places a different command in the clipboard. Per BleepingComputer, "The substituted command first prints a message claiming to download Claude from Anthropic's official website, but actually decodes a Base64-encoded URL pointing to lake-90[.]com." The command then uses curl to silently download a .dat file and pipes it into macOS Z shell (zsh) for execution. Victims see the legitimate Claude installation URL both on the page and in the terminal while a different script runs.
The campaign relies on two layers of cloaking, according to Push Security. First, the compromised WordPress site checks for a Bing referrer and specific browser headers before redirecting a visitor. Second, the fake Claude site uses JavaScript to verify that visitors arrived from Google or Bing; direct visitors receive a 404 page, which defeats automated security scanners that fetch the domain directly.
How was the incident detected?
The campaign was found by Push Security researchers, who detected a malicious Google ad targeting users searching for "claude mac" and published a report on the technique. According to Push Security, whose researchers traced the full click path from the sponsored ad through the Bing redirect and the compromised WordPress site to the fake installer page, the "Adception" name for the technique comes from that report. The findings were covered by staff writer Lawrence Abrams at BleepingComputer on October 9, 2026.
What is the current impact?
The targets are macOS users who search for Claude through Google and click sponsored results, and victims are tricked into executing a malicious shell command in Terminal. According to Push Security, the number of affected users has not been disclosed, and the final payload remains unconfirmed: the company states "it unclear what malware, if any, is being installed." Push Security also identified several domains associated with the same ClickFix toolkit, tracked internally as AcSig, using an identical macOS installation command, payload URL structure, and installer interface, which suggests the toolkit is being reused across multiple fake-download campaigns. Because the attack chain runs through legitimate advertising and redirect infrastructure rather than a vulnerability in Anthropic's software, there is no patch or credential rotation that applies on the victim side.
What are the next steps?
Mitigation sits with the advertising platforms and with users, since no software update addresses the abuse. Per the findings reported by BleepingComputer, the malicious ad chain and the fake domain claude-desk-code[.]com were documented by Push Security, but the takedown status of the ad or the domains was not stated in the coverage. Users installing Claude on macOS should treat terminal commands shown on third-party download pages with caution and verify that any copied command matches the one displayed, since the substitution in this campaign is invisible in both the browser and the terminal output. The broader context Push Security describes, again per BleepingComputer, is a ClickFix ecosystem in which search engine results are the dominant entry point and phishing kits are increasingly produced with AI assistance, which places the burden on ad platforms to police sponsored results that resolve through redirect chains.