Summary
- A Google advertisement presented Bing as the landing domain for a Claude Mac search.
- The attack used a Bing redirect and compromised WordPress website to reach a fake installer.
- The technique exploits assumptions made by ad review, filtering systems and users.
Attackers have used a sponsored Google search result to route users through a Bing search redirect and a compromised website before presenting a counterfeit Claude installer, according to research published by Push Security on 9 October.
The campaign appeared in searches for ‘claude mac’, a query likely to be used by people trying to download the AI assistant for Apple’s desktop operating system. The advertisement displayed bing.com as its domain rather than an obviously suspicious software-download destination. Only after the user followed a sequence of redirects did the page present a convincing fake download.
Push describes the technique as Adception. It is a form of malvertising that uses one reputable search engine’s results inside another search engine’s advertising channel. Each step can look innocuous to systems examining a destination in isolation, while the complete browser journey delivers the visitor to a malicious location.
The chain described in the research involved a Google ad, a Bing search result, and an intermediary compromised WordPress site. The researchers observed cloaking logic that changed what visitors saw depending on the path taken. A scanner opening one of the intermediate addresses directly might not encounter the same content shown to a user completing the whole sequence.
This makes the attack distinct from a conventional advertisement that simply links directly to a counterfeit download. Trust in a well-known domain is borrowed at an early stage of the journey, and the malicious destination appears only after checks that may be absent from an automated review of the original advert.
The fake Claude page encouraged an installation process involving terminal commands. A copied command can differ from text displayed on a website, making it possible to conceal execution behaviour behind familiar installation instructions. That risk is especially acute where users are accustomed to installing developer tools with a one-line shell command copied from documentation.
Push’s findings establish the delivery mechanism and the fraudulent destination, but they do not provide a reliable count of European victims or evidence that Anthropic’s own download infrastructure was compromised. The campaign exploited the popularity of a recognised AI product, not a demonstrated vulnerability in Claude itself.
Advertising abuse also presents a problem of responsibility across services. The advertisement, intermediary search result, compromised content management website and final malicious page may be operated by different parties. Blocking only the last destination can reduce immediate exposure while leaving the enabling account and redirect infrastructure available for reuse.
In enterprise settings, this technique brings software provenance into the browser security discussion. Users may arrive at an installer through a familiar search interface and see recognised domains along the way, yet that does not establish that the installer originated from the software developer.
The research illustrates why a complete navigation chain, including redirects and final actions requested of the user, is needed to understand a malvertising incident. An apparently legitimate search result can be only the first step of a controlled route to unauthorised code execution.
The technical sequence described by Push Security involves several services with different responsibilities. A search advertisement leads the user towards a destination that appears connected with installing legitimate software; an intermediary redirect then conceals where the eventual instruction originates. The decisive action still requires a user to run a command locally. The research does not establish that Anthropic’s own infrastructure was compromised or that every person seeing the advertisement executed the command.
This difference between promotion, redirection and execution affects incident interpretation. Search platforms may serve an advertisement while an unrelated compromised site or attacker-controlled page handles a later part of the sequence. Investigators therefore need the entire navigation and command history before assigning responsibility to any one service. The report illustrates an attack technique, not a verified count of compromised UK or European endpoints.
