---
title: "[AUTO] Malvertising Chains Trust to Deliver Fake Claude Installers"
pubDatetime: 2026-10-10T07:20:00.000Z
description: "Researchers uncovered Adception, a malvertising campaign delivering fake Claude installers through Google ads and Bing redirects to install ClickFix malware."
tags: [ai-security, vulnerability, social-engineering, anthropic, 2026, 2026-q4, 2026-10, AUTO]
---
The Adception campaign shows how malvertising chains together multiple trust layers in a single attack. [Push Security researchers](https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results) found that hackers placed Claude installer ads in Google search results, then redirected victims through Bing's legitimate redirect domain (bing.com/ck/a) to a fake installer on a compromised retailer's site. The fake installer runs what looks like an Anthropic command but actually executes base64-encoded malware from lake-90.com, delivering ClickFix to macOS systems.

The attack works because it hits users at their moment of intent: actively searching for Claude means more likelihood to click quickly without scrutiny. Each link in the chain appears legitimate. Google search results, Bing redirects, installers mimicking real Anthropic syntax all play their part. By the time users see a prompt asking for credentials or payment, they're already primed to trust the path they took to get there.

ClickFix itself is crude. The attack's sophistication is all in the chain: legitimate-looking search results, trusted domain redirects, and installers that mimic real Anthropic commands. Users never get a moment to reconsider what they're doing.

---

*Sources: [Adception: Malvertising & Another Search Engine's Trusted Redirects](https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results)*

*Coverage: [Hackers Abuse Google Ads, Bing Redirects to Push Claude ClickFix Attacks](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/)*

*Related on this blog: [[AUTO] AI Evasion Techniques Go Mainstream in Phishing](/posts/auto-ascii-smuggling-phishing)  •  [[AUTO] ChatGPT Powered a Fake Think Tank for Russian Disinformation](/posts/auto-russian-influence-chatgpt)  •  [AISI's Test Agents Took 19 Unsanctioned Actions Against Real Targets](/posts/aisi-unsanctioned-agent-actions-cyber-eval)*