Criminals are exploiting Google search advertisements to distribute a malware attack called ClickFix that targets Claude users on macOS. The scheme, identified by Push Security researchers and called “Adception,” uses Bing’s legitimate domain in ads to bypass security checks. When users click the advertisement after searching for “claude mac,” they are redirected through multiple layers to a fake Claude installer page. The attack employs cloaking techniques to hide the malicious content from security scanners and direct visitors.
The fraudulent installer appears authentic but conceals dangerous commands. While displaying Anthropic’s legitimate installation instructions, the page actually copies a malicious command to users’ clipboards. This command downloads and executes an unknown payload from an attacker-controlled server while showing legitimate Claude installation details in the terminal. Researchers discovered several related domains using identical methods, suggesting the same ClickFix toolkit is behind multiple attack variations.
Source: Read the full story at BleepingComputer
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
