Attack Chain: How Hackers Abuse Bing Redirects in Google Ads
Security researchers at Push Security have identified a sophisticated malvertising campaign where threat actors abuse legitimate Bing search-result redirects as click URLs in Google search advertisements to distribute fake Claude installers carrying ClickFix attacks. The technique, internally referred to as "Adception," leverages Bing's trusted domain to bypass advertising security checks, making the sponsored ads appear legitimate to both users and automated scanners.
The attack begins when users searching for terms like "claude mac" encounter a sponsored Google ad displaying bing.com as the destination URL. This leverages Bing's reputation to evade detection by Google's ad review systems. Upon clicking, the ad traffic first passes through Google's advertising redirect infrastructure before reaching Bing's bing.com/ck/a click-tracking endpoint, which then forwards the visitor to a legitimate but compromised WordPress website belonging to a South American retailer.
Compromised Website and Traffic Redirection
The compromised WordPress site acts as an intermediary redirector, employing cloaking techniques to ensure only traffic originating from Bing or Google proceeds to the malicious payload. The site checks for a Bing referrer and specific browser headers before allowing redirection. Visitors who meet these criteria are sent to claude-desk-code[.]com, a domain designed to mimic a legitimate Claude download page for macOS users.
To further evade detection, the campaign implements two layers of cloaking. First, the compromised WordPress website validates the referral source and browser environment before redirecting. Second, the fake Claude installer page uses JavaScript to verify that visitors arrived via Google or Bing. Direct access to the malicious URLs results in a 404 error page, hindering analysis by automated security scanners and researchers attempting to investigate the infrastructure.
Deceptive Claude Installer Triggers ClickFix Attack
The final destination is a convincing replica of an official Claude download page that presents users with what appears to be the legitimate installation command for Anthropic's Claude assistant on macOS: curl -fsSL https://claude.ai/install.sh | bash. However, the page's functionality has been subverted to deliver a payload through a ClickFix mechanism.
While the displayed command matches Anthropic's genuine installation script, interacting with the copy button on the page replaces the clipboard contents with a malicious alternative. This substituted command begins by outputting a deceptive message claiming to download Claude from Anthropic's official infrastructure, but in reality, it decodes a Base64-encoded URL pointing to lake-90[.]com.
The script then uses curl to silently retrieve a .dat file from this attacker-controlled server and pipes its contents directly into the macOS Z shell (zsh) for immediate execution. As a result, victims observe the legitimate Claude installation URL both on the webpage and in their terminal window, creating a powerful illusion of authenticity while an entirely different and potentially harmful script runs in the background.
Attack Infrastructure and Payload Uncertainty
Push Security researchers noted that this campaign is part of a broader pattern involving multiple domains associated with what they internally track as the AcSig ClickFix toolkit. These domains share identical characteristics: the same macOS installation command structure, payload URL formatting, and installer interface design, indicating a standardized toolkit being reused across different lures.
Despite the detailed analysis of the delivery mechanism, the ultimate payload delivered by this specific ClickFix variant remains unidentified. Push Security has not determined what specific malware, if any, is being installed through the execution of the remote .dat file, leaving the potential impact — ranging from data theft to persistent access — uncertain pending further investigation.
Source: BleepingComputer