CTI · reviewed · 2026-10-10
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
Actors
AcSig
Malware / tools
fake Claude installer (ClickFix)
Campaigns
Adception malvertising
CVEs
—
Victim sectors
technology
Geography
global
MITRE ATT&CK
Indicators
No curated indicators tied to this case.
Detections
Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.
Sigma raw
title: ClickFix Fake Claude Installer C2 Domains (AcSig / Adception)
id: 3f8c1d62-9a47-4e2b-8c15-7d2a6f4b90e1
status: experimental
description: Detects network connections to domains serving fake Claude installers in the Adception malvertising campaign that abuses Bing redirect URLs to deliver the AcSig ClickFix toolkit
references:
- https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/
- https://fawkes.rocks/2026/10/09/claude-clickfix-attacks-abuse-google-ads-and-bing-redirects/
author: Tia N. List
date: 2026-10-10
tags:
- attack.resource-development
- attack.t1583
- attack.stealth
- attack.t1036
- attack.execution
- attack.t1674
- attack.t1204
logsource:
category: network_connection
product: windows
detection:
selection:
dst_domain|endswith:
- 'claude-desk-code.com'
- 'cli-desktop.com'
- 'lake-90.com'
condition: selection
falsepositives:
- Unlikely; these domains were staged for the October 2026 campaign. Investigate any hit
level: high