Push Security researchers have documented a malvertising technique dubbed "Adception" in which attackers abuse legitimate Bing search-result redirects as click URLs inside Google search ads, directing users searching for terms like "claude mac" to fake Claude download pages that deliver ClickFix attacks. The sponsored result displays Bing's trusted bing.com domain, apparently to evade advertising security checks; clicking passes through Google's ad redirect, then Bing's bing.com/ck/a click-tracking endpoint, then a compromised WordPress site belonging to a South American retailer, before landing on claude-desk-code[.]com. Two layers of cloaking — a Bing-referrer check on the WordPress site and JavaScript origin validation on the fake page — redirect direct visitors to a 404 to defeat scanners. The fake installer page shows Anthropic's genuine curl -fsSL https://claude.ai/install.sh | bash, but the copy button places a substituted command in the clipboard that silently downloads a .dat file from lake-90[.]com and pipes it into macOS zsh for execution. The final payload is unknown. Push tracks related domains as the "AcSig" ClickFix toolkit.

• Source article