Hackers use Bing redirects in Google ads for fake Claude installers

As reported by Bleeping Computer, hackers are employing a sophisticated technique called "Adception" to distribute malware by abusing legitimate Bing search-result redirects within Google search ads. This method aims to trick users into downloading fake Claude installers that ultimately deliver ClickFix attacks.

The "Adception" campaign leverages Bing's trusted domain as an initial ad destination in Google ads, making them appear less suspicious. After a user clicks the ad, it passes through Google's redirect and then Bing's click-tracking endpoint, which forwards the browser to a compromised South American retailer's website. This site then redirects the user to a fake Claude download page, `claude-desk-code[.]com`. The campaign employs multiple layers of cloaking, checking for specific referrers and browser headers, to prevent security scanners and direct visitors from detecting the malicious payload. The fake installer mimics the legitimate Claude installation command for macOS users but replaces it with a malicious command that silently downloads and executes an unknown payload from an attacker-controlled server. This technique allows the attack to remain hidden, as users see the legitimate Claude installation process while a different, malicious script is executed in the background.

Source: Bleeping Computer