A sophisticated scam targeting Americans searching for Claude AI assistant uses Google advertisements and Microsoft’s Bing search engine to disguise dangerous malware as legitimate software downloads. Security researchers discovered the attack specifically targets Mac users through fake installation pages that copy malicious commands onto victim computers while displaying harmless text on screen.
How The Digital Trap Works
The attack begins when users search Google for “Claude Mac” and click what appears to be a legitimate sponsored result showing bing.com as the destination. Security firm Push Security uncovered that clicking the advertisement sends victims through multiple redirects. First through Google’s advertising system, then through Bing’s legitimate click-tracking service, followed by a compromised WordPress website belonging to a South American retailer, before finally landing on a fake Claude download page at claude-desk-code[.]com.
Researchers jokingly named the technique “Adception” because it exploits how Google ads and Bing redirects function to create layers of apparent legitimacy. The attackers deliberately used a real Bing search result for a compromised website, allowing them to display Microsoft’s trusted domain in the Google advertisement while using Bing’s click-tracking to redirect visitors toward the malicious destination. By the time users reach the fake download page, they have little reason to suspect the journey began with a fraudulent advertisement.
Invisible Commands Threaten Computer Security
The scam includes an additional deception layer that makes detection extremely difficult. The fake installer displays one command on screen while secretly copying a completely different malicious command to the user’s clipboard. The compromised retailer website checks whether visitors arrived through Bing and examines browser information, while the fake Claude website verifies visitors came from Google or Bing. Anyone visiting the malicious website directly sees only a 404 error page instead of the fake installer, making investigation by security scanners nearly impossible.
Push Security calls this protective technique “cloaking,” which attackers use to control who reaches malicious content while showing harmless pages to other visitors. The researchers observed two separate verification checks designed to shield the attack from unwanted attention, creating a carefully constructed path that makes the dangerous destination appear trustworthy.
Protecting Yourself From Download Scams
This attack demonstrates how criminals exploit trusted platforms like Google and Microsoft to distribute malware. Americans should verify software downloads come directly from official company websites rather than clicking sponsored search results. Type website addresses directly into browsers instead of relying on search engine advertisements, particularly when downloading software that accesses sensitive information. The scam specifically targets Mac users who may assume Apple computers face fewer security threats than Windows machines.