Push Security researchers reported a campaign that used a sponsored Google search result to direct some people searching for “Claude Mac” to a counterfeit download page. The route passed through legitimate Google and Bing services before reaching a compromised website and then a page impersonating Anthropic’s Claude software. The source material does not give a date for when the researchers first observed the campaign.
According to Push Security, the advertisement showed a Bing address, which could make the link appear more credible. After a user clicked, Google’s advertising system processed the visit, Bing’s click-tracking service redirected the browser, and a compromised WordPress site belonging to a South American retailer forwarded the visitor to a fake Claude page. The researchers identified the final address as claude-desk-code[.]com.
The reported campaign used different behavior depending on how a visitor arrived. The compromised site checked for signs that a visitor came through Bing, while the fake download page checked for a Google or Bing referral. Push Security said a person visiting the counterfeit page directly might instead see a 404 error. Such filtering, often called cloaking, can make a campaign harder for investigators and automated scanners to observe in the same way as its intended targets.
The fake page presented an installation command that appeared to reference Anthropic’s legitimate website. But Push Security found that clicking the page’s Copy button put a different command on the clipboard. The copied text used Base64 encoding to conceal an address controlled by the attackers. If run in macOS Terminal, the command displayed a reassuring message, decoded the hidden address, downloaded a remote script and passed it to the Mac’s Z shell for execution.
Push Security characterized the approach as an InstallFix attack, a form of ClickFix that persuades users to run harmful commands themselves by presenting them as installation or troubleshooting instructions. The company said it found other websites using the same toolkit, which it tracks as AcSig, with similar fake installer designs and matching commands.
The researchers’ account describes how the command retrieves and executes a script, but does not identify the script’s final payload or establish what it does after running. The report therefore does not confirm that this campaign stole information, changed files or installed additional software. Those are possible risks of running untrusted code, not outcomes established by the findings presented in the source material.
Push Security also said four out of five ClickFix attacks it detects reach victims through search engines. That statistic reflects the company’s own detection data; it is not a measurement of all such attacks worldwide.
Google told CyberGuy it had suspended advertiser accounts associated with the reported campaign. A company spokesperson said distributing malware through ads violates its policies and that Google updates its detection systems to address evolving tactics. Google also said attackers may use cloaking to show advertising reviewers different content from what users encounter.
Microsoft told CyberGuy that its security protections detect and block the malicious indicators described in the research. Anthropic was contacted for comment but had not responded by the source’s deadline.
The reported risk centers on users being persuaded to paste and run a command, rather than simply downloading a conventional installer. The source advises people to obtain Claude through Anthropic’s official download page or use claude.ai, and to be wary of software pages that ask them to enter commands in Terminal. It also recommends checking copied text in a plain-text editor before running unfamiliar commands, keeping macOS and browsers updated, and reviewing who paid for sponsored search placements. The source notes that these precautions and security software cannot guarantee protection against every threat.
People who already ran a command from a suspicious Claude download page should not assume their Mac is safe merely because nothing unusual appeared on screen. Push Security has not determined the final script’s behavior, leaving the campaign’s ultimate impact uncertain.
