On October 9, 2026, Push Security published research it calls "Adception", and BleepingComputer covered it the same day. It began with a sponsored Google result for the search "claude mac" whose displayed domain was bing.com. In Push's words: "Google's ad review approved a destination that was simply another search engine."
The chain
- Ad to Bing. The click went through Google's ad redirect to
bing.com/ck/a, the click-tracking redirect Bing puts behind its own search results. Push explains that Bing forwards the visitor "with a short JavaScript page rather than an HTTP redirect", with the destination base64-encoded in a URL parameter. - Bing to a hacked site. The next hop was a real, search-indexed "about us" page on a South American homeopathy retailer's WordPress site, which the attacker had compromised.
- Cloaking. BleepingComputer describes two layers. The WordPress site checks for a Bing referrer and specific browser headers, and the fake site checks that the visitor came from Google or Bing. Direct visitors get a 404.
- The swap. The final page was a convincing Claude download page showing Anthropic's real one-line installer. But, as BleepingComputer puts it, "clicking the copy button places a malicious command in the clipboard." Push says the pasted command prints a message claiming to download Claude from claude.ai, then decodes a hidden URL and pipes a script from
lake-90[.]cominto zsh. "A user who reads the page and then watches the terminal sees a legitimate Claude URL both times."
Push links the lure domains to a ClickFix toolkit it tracks as AcSig, which shares an identical macOS command across several sites. Bing's redirect has been abused before in phishing emails and QR codes, Push notes, "But we hadn't seen it used as the destination of a search ad, and found no prior public reporting of that." Neither source identifies the final payload, and neither reports a response from Google, Microsoft or Anthropic.
Why this keeps happening to agent installs
This is not a one-off. Malwarebytes reported in May that sponsored results for Claude Mac downloads led to shared Claude chats that told victims to paste a base64-encoded command into Terminal, which pulled and ran a loader script from attacker-controlled infrastructure. Push has separately documented "InstallFix" pages that spread through sponsored results for "Claude Code install". The common thread is that installing a coding agent normally means pasting a curl ... | bash line from a web page. That habit is exactly what ClickFix attacks need.
What remains uncertain. The payload, the number of victims, and whether Google has closed the gap that let an ad point at another search engine's redirect.
Analysis: For teams rolling out coding agents, the fix is mostly process. Install agents from a package manager, an internal mirror or a managed device profile, not from a search result. Tell developers never to paste an install line copied from a page they reached through an ad. Treat a "copy" button as untrusted, and paste into a text editor before a terminal. Push says short-lived indicators of compromise are of limited value against campaigns like this, and that it caught the chain by analysing the full browser session and detecting the malicious copy and paste.
Push Security found a Google search ad for 'claude mac' that listed bing.com as its destination, passed Google's review, and chained through Bing's click redirect and a hacked retailer's site to a fake Claude installer whose copy button put a malicious zsh command on the clipboard.