Cybercriminals are exploiting Google advertisements and Microsoft Bing to trick users into downloading malware disguised as Claude AI software, security researchers warn. The sophisticated scheme uses legitimate search engine systems to hide malicious downloads that could compromise Mac computers.
How The Attack Works
The scam begins when users search for Claude Mac on Google and click a sponsored advertisement showing bing.com as the destination. Security firm Push Security discovered that clicking this ad triggers multiple redirects through Google’s advertising system, then Bing’s click-tracking service, before routing through a compromised WordPress website belonging to a South American retailer. The final destination appears as claude-desk-code.com, a fake download page designed to mimic the legitimate Claude installation experience.
Researchers labeled this technique Adception because attackers deliberately used a real Bing search result for a compromised website. This allowed them to display Bing’s legitimate domain in the Google advertisement while using Bing’s tracking redirect to send visitors toward malicious destinations. By the time users reach the fake download page, they have little reason to suspect the journey began with a fraudulent advertisement.
Cloaking Technique Evades Detection
The attackers implemented what security experts call cloaking to make their operation harder to detect. The compromised retailer website checks whether visitors arrived through Bing and verifies specific browser information. Meanwhile, the fake Claude website confirms visitors came from Google or Bing. Anyone who visits the malicious website directly sees a 404 error page instead of the fake installer, making it difficult for security scanners to investigate the attack.
Push Security warns the fake installer displays one command on screen while secretly copying another dangerous command to user systems. This deception adds another layer of risk, as victims believe they are installing legitimate software while actually running malicious code that could compromise their Mac computers and personal data.
What This Means
The discovery highlights how cybercriminals exploit trusted platforms like Google and Microsoft to distribute malware. Users should verify download sources directly by typing official website addresses into browsers rather than clicking advertisements. Security experts recommend scrutinizing download pages for subtle inconsistencies and using official app stores when available to reduce exposure to these sophisticated scams.