Tia N.List

Reported by 5 outlets

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

new1.9
Why this score
Breadth
2.00 / 2.0 · 5 sources
Authority
1.80 / 2.0 · best outlet weight
Severity
0.50 / 5.0 · CVSS + content signals
Velocity
0.50 / 2.0 · updates in 48h
Pickup speed
0.26 / 0.6 · time to second source
Recency
× 0.38 temporal multiplier
Community
+ 0.00 / 1.5 · reddit signal
Score
1.9 / 10 = base × recency + community
bleepingcomputer.compushsecurity.comfawkes.rocksall-about-security.deppc.land desk first seen 4d ago

Desk analysis

Hackers are abusing sponsored Google Ads and Bing click-tracking redirects to deliver a ClickFix toolkit (tracked as AcSig) that pushes fake Claude desktop installers. Push Security documented a sponsored result for the query claude mac that routed through Bing redirects and a compromised WordPress site (homeopatiaalemana[.]com) before landing on claude-desk-code[.]com. Additional linked domains include cli-desktop[.]com and lake-90[.]com. The embedded Bing click timestamp decodes to October 5, 2026. This is a supply-chain-style social-engineering campaign targeting developers and AI users.

Monitor the listed IOCs (claude-desk-code[.]com, cli-desktop[.]com, lake-90[.]com) and review endpoint protection for ClickFix toolkit behaviors. Watch for similar sponsored-ad campaigns impersonating other developer or AI tools.

Timeline

  1. original reporting

    Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

    bleepingcomputer.com · 4d ago · October 9th, 2026

    Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. The technique, dubbed "Adception" by security researchers at Push Security, appears designed to evade advertising security checks by using Bing's trusted domain as the ad destination, before redirecting victims through a compromised website to the malicious download page. The attack also uses multiple layers of cloaking to prevent security scanners and visitors who access the malicious URLs directly from seeing the payload. According to a report published by Push Security , the campaign was discovered after researchers detected a malicious Google ad targeting users searching for "claude mac." Unlike typical malvertising campaigns that direct victims to attacker-controlled domains, the sponsored result displayed the legitimate bing.com domain, making the advertisement appear less suspicious. When clicked, Push says the ad first passed through Google's advertising redirect before reaching Bing's bing.com/ck/a click-tracking endpoint, which forwarded the browser to a legitimate but compromised WordPress website belonging to a South American retailer. The compromised website then redirected the visitor to claude-desk-code[.]com , a fake Claude download page designed to trick macOS users into executing malicious commands. Bing's click-tracking redirects use JavaScript to send visitors to their destination, allowing

  2. update from pushsecurity.com

    Adception: malvertising another search engine's search results to redirect to a malicious page

    pushsecurity.com · 5d ago · October 9th, 2026

    Push Security's original disclosure by Luke Jennings documents a sponsored Google result for the query claude mac that displayed bing.com as its destination, then routed clicks through Bing's bing.com/ck/a click-tracking redirect and a compromised WordPress page on homeopatiaalemana[.]com before landing on the fake installer site claude-desk-code[.]com. The embedded timestamp in the Bing click link decodes to October 5, 2026, indicating the redirect chain was staged days before publication. The team links the campaign to a shared ClickFix toolkit it tracks as AcSig, seen across additional domains including cli-desktop[.]com and lake-90[.]com, and lists IoCs at the end of the post.

  3. update from fawkes.rocks

    Claude ClickFix attacks abuse Google Ads and Bing redirects https:// fawkes.rocks/2026/10/09/claude -clickfix-attacks-abuse-google-ads-and-b

    fawkes.rocks · 4d ago · October 9th, 2026

    Claude ClickFix attacks abuse Google Ads and Bing redirects https:// fawkes.rocks/2026/10/09/claude -clickfix-attacks-abuse-google-ads-and-b

    via Mastodon https://fawkes.rocks/2026/10/09/claude-clickfix-attacks-abuse-google-ads-and-bing-redirects/

  4. mentioned by www.bleepingcomputer.com

    🤖 ClickFix: attackers abuse legitimate Bing search-redirect URLs as click targets in Google Ads, pointing users to fake Claude installers th

    www.bleepingcomputer.com · 4d ago · October 10th, 2026

  5. mentioned by www.all-about-security.de

    Claude ClickFix: Attackers abuse Google Ads and Bing redirects

    www.all-about-security.de · 3d ago · October 10th, 2026

  6. mentioned by www.bleepingcomputer.com

    Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks https://www.bleepingcomputer.com/news/security/hackers-abuse-google

    www.bleepingcomputer.com · 3d ago · October 10th, 2026

  7. mentioned by www.bleepingcomputer.com

    Hackers abuse # Google Ads, # Bing redirects to push # Claude # ClickFix attacks https://www. bleepingcomputer.com/news/secu rity/hackers-ab

    www.bleepingcomputer.com · 1d ago · October 12th, 2026

  8. update from ppc.land

    FYI: Analytics engineer phished through Google ad for Google Cloud Console: Fake Cloud Console page on sites.google.com fed logins to accoun

    ppc.land · 1d ago · October 12th, 2026

    FYI: Analytics engineer phished through Google ad for Google Cloud Console: Fake Cloud Console page on sites.google.com fed logins to accoun

    via Mastodon https://ppc.land/analytics-engineer-phished-through-google-ad-for-google-cloud-console/

Covered in

digest 2026-10-10

Source on GitHub