Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks. The attack also uses multiple layers of cloaking to prevent security scanners and visitors who access the malicious URLs directly from seeing the payload. According to a new report by Push Security, the campaign was discovered after researchers detected a malicious Google ad targeting users searching for "claude mac." The compromised website then redirected the visitor to claude-desk-code[.]com, a fake Claude download page designed to trick macOS users into executing malicious commands.

First reported by BleepingComputer. This page is a short excerpt; the full text is theirs.