Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Hackers are leveraging Google Ads and abusing Bing's legitimate redirect infrastructure to deliver 'ClickFix' attacks that impersonate official Claude installers for macOS. The malicious ads appear to point to bing.com, evading suspicion and ad security checks, then redirect through a compromised WordPress site to a fake download page at claude-desk-code[.]com. The page uses cloaking techniques to hide the payload from direct access and security scanners, while tricking users into copying a malicious command that downloads and executes a script from lake-90[.]com. The final payload remains unidentified, but the campaign is linked to the ClickFix toolkit tracked internally as AcSig.

AI-extracted · verify before operational use