TLDR
Hackers are running sponsored Google ads that display the trusted bing.com domain as the destination, exploiting Bing's click tracking endpoint to redirect victims through a compromised WordPress site to a fake Claude for macOS installer....
How it works
Hackers are running sponsored Google ads that display the trusted bing.com domain as the destination, exploiting Bing's click tracking endpoint to redirect victims through a compromised WordPress site to a fake Claude for macOS installer....
Red flags
- : Sponsored ad shows bing.com but chains through redirects before reaching an unrelated, unfamiliar download domain Copy button replaces the on screen installation command with a longer Base64 encoded one that pipes to zsh Final URL is not claude.ai but a lookalike such as claude desk code[.]com or lake 90[.]com
What to do
- 1: Always download software from the official site (claude.ai) or the Mac App Store
- 2avoid clicking ads Inspect copied commands before pasting them into Terminal, and never pipe curl output directly to a shell Report malicious ads via Google Ads Report ad and block the destination domain
- 3keep macOS and browser updated
Source
bleepingcomputer
Source reviewed by Mythos Forensic Team
https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/FAQ
Is Malicious Google Ads Exploit Bing Redirects to Spread Fake Claude Installers via ClickFix a real scam pattern?
Yes. Treat the message, call, or payment request as suspicious until you verify it through an official channel.
What are the first warning signs?
: Sponsored ad shows bing.com but chains through redirects before reaching an unrelated, unfamiliar download domain Copy button replaces the on screen installation command with a longer Base64 encoded one that pipes to zsh Final URL is not claude.ai but a lookalike such as claude desk code[.]com or lake 90[.]com
What should I do first?
: Always download software from the official site (claude.ai) or the Mac App Store; avoid clicking ads Inspect copied commands before pasting them into Terminal, and never pipe curl output directly to a shell Report malicious ads via Google Ads Report ad and block the destination domain; keep macOS and browser updated
Can LegalAudit check my case?
Yes. Start a free chat and paste the message, link, sender, or payment details for triage.