Push Security reported on 9 October 2026 that a Google ad shown to people searching for “claude mac” displayed bing.com as its address but led, through a chain of redirects, to a fake Claude download page aimed at Mac users [1]. The page shows the real installation command but copies a different one to the clipboard, which the visitor then pastes into Terminal [1] [2].
Background
ClickFix is a technique in which a web page persuades the visitor to run a command themselves, so that the attacker’s code starts from the user’s own action. Push Security states that 4 in 5 ClickFix attacks it sees reach victims through search engines [1]. Installing developer tools with a pasted command is normal practice, which is why the technique suits them.
What the reports describe
According to Push Security, the sponsored result showed “bing.com” as its domain. A click went through Google’s ad redirect, then Bing’s click-tracking redirect, then a compromised retailer’s website, and finally the fake page at claude-desk-code[.]com [1] [2]. The compromised site only redirects visitors who arrive with a Bing referrer and specific browser headers, and the final page sends other visitors to a 404 page, which Push says helps the campaign avoid scanners and direct visits [1].
The page displays Anthropic’s genuine command, curl -fsSL https://claude.ai/install.sh | bash. Pressing its copy button instead places a different command on the clipboard: one that decodes a Base64 string into a web address, downloads whatever is there and runs it in the zsh shell [1] [2]. Push reports eight further lure domains using the same toolkit, which it tracks as AcSig [1] [2]. BleepingComputer reports that the final payload was not identified, while Push describes the script as a macOS installer script from that toolkit [1] [2].
Fox News reports that Google suspended the advertiser accounts, that Microsoft confirmed Defender detects the indicators, and that Anthropic did not respond before publication [3]. Push’s own post and BleepingComputer’s report of 9 October do not state these responses.
Implications for Mac users
The displayed address, the vendor’s name and the instruction on the page can all look right, and the page can still copy something else. The step that decides the outcome is the paste. Ads for software searches are a place where attackers pay to appear first, so the top result is not a sign of trust.
Recommendations
- Open the vendor’s own site by typing its address or from a saved bookmark, and treat sponsored results for installers as untrusted.
- Before pasting a command into Terminal, paste it into a text editor first and read it. A command that contains an encoded string or pipes a download into a shell is not the one the page showed.
- Type commands from the vendor’s documentation yourself when the command is short, instead of using a copy button.
- Stop at a Terminal command you do not understand and ask the vendor or a colleague.
- Keep macOS updated and review which apps may connect to the internet.
Relevance to FireAI
FireAI is a firewall for outgoing connections on the Mac. It shows which program made a connection and where it went, and lets the user block that program. It does not read the clipboard, inspect advertisements or web pages, or recognise this campaign, and it cannot stop a user from pasting a command. Seeing and blocking a connection the user did not expect is the part it covers.
Limitations
The sources differ on whether the payload was identified, and none of them states what data the final program takes [1] [2]. The company responses come from Fox News alone [3]. The campaign was found through one ad for one search; how many people saw it is not stated.
Try FireAI, by HisnLabs free for 17 days.