GoKawiilFake Claude installer ads abuse Bing redirects to evade Google Ads security checks
Push Security reports that a malvertising campaign is routing Google search ads through Bing's trusted click-tracking domain before funneling victims through a hacked WordPress site to a fake Claude download page. The scheme, found after a malicious ad surfaced for searches like "claude mac," uses layered cloaking checks to hide the malicious payload from scanners and direct visitors, ultimately pushing macOS users toward ClickFix-style attacks that trick them into running malicious commands.
GoKawiil's interpretation of the reporting above, not reported fact.
By disguising the ad destination as bing.com rather than an attacker-owned domain, the technique could make it easier to slip past ad-platform vetting that typically flags suspicious URLs, according to Push Security's analysis. The use of a compromised legitimate retailer's site as an intermediate hop further complicates detection, since the traffic pattern looks like normal referral activity rather than a direct attack chain.
- Attackers are exploiting Bing's bing.com/ck/a click-tracking redirect to mask malicious ad destinations behind a trusted domain.
- The campaign targets macOS users searching for Claude, luring them to a fake install page running a ClickFix-style command attack.
- Multiple cloaking layers—checking referrers and browser headers—prevent security scanners and direct visitors from seeing the malicious payload.
YubiKey 5 Series Security Key — With attackers increasingly using fake installers and ClickFix-style social engineering to hijack credentials, hardware-backed authentication is one of the few defenses that resists these tricks. A YubiKey adds phishing-resistant multi-factor authentication to your accounts, so even if you're fooled by a convincing fake download page, your logins stay protected. It's a simple, durable upgrade to everyday browsing security.
See YubiKey 5 Series Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-10-09
Published there as: “Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.