Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Hackers are using a technique called 'Adception' to bypass security filters by embedding Bing redirect links within Google search ads. These ads lead users to compromised websites that ultimately serve fake Claude installers designed to compromise macOS systems.
Why it matters
This sophisticated malvertising campaign demonstrates how attackers exploit trust in major search engine infrastructure to distribute malware, posing a significant risk to enterprise and consumer security.
Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks.
The technique, dubbed "Adception" by security researchers at Push Security, appears designed to evade advertising security checks by using Bing's trusted domain as the ad destination, before redirecting victims through a compromised website to the malicious download page.
The attack also uses multiple layers of cloaking to prevent security scanners and visitors who access the malicious URLs directly from seeing the payload.
According to a report published by Push Security , the campaign was discovered after researchers detected a malicious Google ad targeting users searching for "claude mac."
Unlike typical malvertising campaigns that direct victims to attacker-controlled domains, the sponsored result displayed the legitimate bing.com domain, making the advertisement appear less suspicious.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in