A Google search ad for "claude mac" that listed its destination as bing.com led Mac users to a convincing fake Claude download page, Push Security researcher Luke Jennings reported on October 9. The trick, which Push half-jokingly calls "Adception", buried a real Bing search result inside a Google ad, so the ad's approved landing site was simply another search engine.
That matters because ad review, URL filters and wary users all judge a link by the domain they can see. Here, every domain they could see was legitimate.
A search ad that points at a search engine
Clicking the ad produced four hops, according to Push: Google's own ad-click redirect, Bing's click-tracking redirect, a compromised "about us" page belonging to a legitimate South American homeopathy retailer, and finally the lure at claude-desk-code[.]com. Bing places that tracking link behind every result on its pages, with the destination base64-encoded in a URL parameter, and forwards the browser with a short JavaScript page. The visitor therefore reaches the next hop carrying a genuine bing.com referrer. A timestamp in the link decodes to October 5, 2026, which Push says is probably when Bing generated it.
Push says Bing's redirect has been abused before in phishing emails and QR codes, but it had not seen one used as the destination of a search ad and found no prior public reporting of that.
Two gates keep scanners out
The hacked retailer site runs a server-side check that only forwards visitors arriving with a Bing referrer and particular browser headers. The fake Claude site adds a second check in JavaScript: anyone whose referrer does not contain Google or Bing is sent to a 404 page. Ad reviewers, automated scanners and researchers opening the URL directly see nothing malicious. Push found that arriving from Bing also served the lure, which it reads as a sign the real targets were Google users.
The command you see is not the one you copy
The final page mimics Claude's download page, with a "Download for macOS" button and a one-line terminal install step. That is the InstallFix pattern Push documented earlier this year, and close kin to the fake Claude Code guide that dropped a Mac stealer in August. The page displays Anthropic's real install command, but its Copy button puts something else on the clipboard: a command that prints "Downloading Claude" next to the genuine claude[.]ai address, then quietly decodes a hidden URL and pipes a script from lake-90[.]com into zsh. A user who checks both the page and the terminal output sees a legitimate Claude address each time.
The final payload has not been identified, as NSFOCUS noted in its analysis of the campaign, so what victims actually received cannot yet be scoped. Push links the lure to several other domains sharing the same macOS command, payload URL structure and install pop-up code, a ClickFix toolkit it tracks as AcSig. ClickFix is the umbrella name for lures that trick people into pasting and running commands themselves, and Push says 4 in 5 of the ClickFix attacks it detects, including InstallFix and LLMshare variants, reach victims through search engines.
Take the install command from Anthropic's own site
Install Claude only from claude.ai or Anthropic's documentation, and do not trust a page's Copy button: paste into a text editor first to see what is really on the clipboard. Treat any sponsored search result for software with suspicion, whatever domain it displays. For defenders, domain reputation will not catch this chain, because every hop before the lure is a legitimate site; Push argues that visibility into the full browser session and clipboard-write events is what stops it. Anyone who ran a Claude install command reached through a search ad should investigate that Mac.
Indicators
- Lure domains: claude-desk-code[.]com, cli-desktop[.]com, ksmgakajgpsals.pages[.]dev, rapid-craft567[.]com, too.clawddddd[.]com, fine-byte2[.]com, fairpoint29[.]com, turbowave45[.]com
- Compromised redirect: hxxps://homeopatiaalemana[.]com/quienes-somos/
- Payload host: lake-90[.]com
- Google ad campaign ID: 24303361122
AI tools have become one of the most reliable brands to impersonate, from abused Claude shared chats to this. What is new is the patience: every checkpoint in this chain did its job on the URL it was shown, and none of them was shown the whole chain.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.