Security firm Push Security reported on October 9, 2026, that a fake Claude installer campaign began with a Google sponsored result for claude mac.
Push called the technique Adception, a play on malvertising another search engine’s search results. The ad displayed bing.com, but the observed path had four main hops: a Google ad-click redirect, a Bing search-result click tracker, a legitimate but compromised South American retailer page and a fake Claude download page. The compromised site forwarded selected visitors to the lure, while other visitors could see harmless content or a 404-style dead end.
That filtering matters. Push said the compromised site checked for a Bing referrer and certain browser headers before redirecting. The fake Claude page then checked whether the visitor appeared to arrive from Google or Bing. Direct visits to the final site did not show the same payload, making the attack harder for scanners and casual reviewers to reproduce.
Google’s malicious software policy says Google Ads does not allow intentional malware distribution or attempts to trick or bypass ad review. Push’s report therefore points to evasion, not ordinary ad placement: the early links in the chain looked more trustworthy than the final destination.
The installer page showed one command and copied another
The fake page imitated a Claude download flow for macOS. Push said it displayed Anthropic’s real Claude installer command, but the Copy button placed different text on the clipboard.
The substituted command printed a reassuring message naming the official Claude installer, then decoded a hidden attacker-controlled address and piped a downloaded file directly into the macOS shell. A person checking only the visible page text would not necessarily see the command that was actually about to run.
BleepingComputer reported that the final payload had not been identified at the time of its October 9 article. Push said it found several domains tied to the same criminal ClickFix toolkit, which it tracks as AcSig, using the same macOS command, payload structure and installer interface.
Why AI install pages are useful lures
Anthropic’s own Claude Code documentation includes command-line installation options. That makes fake installer pages more convincing because a terminal command is not automatically suspicious for this kind of developer tool. The security question is whether the source and copied text are legitimate.
The Claude lure also fits a wider pattern of AI-themed search abuse. In a separate report, Island said a three-month observation period ending in August 2026 included about 850 paid-ad landings, 26 lookalike ChatGPT destinations and 71 Google Ads campaign IDs in a broader delivery cluster. Island cautioned that those figures described delivery activity, not infections. Huntress separately reported at least 40 incidents connected to a Google Sites domain used in a Custom GPT and ClickFix campaign.
Those reports do not prove the same operator was behind the Claude chain. They do show why AI tools have become effective lures: many employees now expect to install assistants, browser extensions, coding tools and desktop apps from pages found through search.
What businesses can take from the report
For small businesses, the practical response is to make software acquisition less dependent on search results. Search ads, familiar redirect domains and polished download pages are weak trust signals on their own.
Give staff approved install paths. AI tools, browsers, remote support apps and developer utilities should be linked from an internal software page or managed catalogue.
Treat copy-and-paste terminal prompts as high risk. A page that asks for a Terminal, shell, PowerShell or Windows Run command deserves verification outside the page itself.
Compare copied text before execution. The Push case shows why visible page text is not enough; the clipboard can contain a different command.
Look beyond email during incident response. If a suspicious AI tool was installed, browser history, DNS records, endpoint telemetry and password or session-token exposure may be more relevant than inbox evidence.
The public reports reviewed for this article did not identify a victim count or a named threat actor for the Claude installer chain. They also did not report a compromise of Anthropic’s systems.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
