Fake Claude installer at claude-desk-code.com pushed via Google Ads
Push Security found Google search ads routed through Bing redirects sending people searching "claude mac" to claude-desk-code.com, a fake Claude download page that copies a malicious command.
- First reported
- Reports
- 1
Source: geekfeed.net · published
What happened
Geek Feed reported on October 13, 2026, citing Push Security, that attackers bought Google search ads targeting people searching for "claude mac". The ad showed the legitimate bing.com domain, then passed through Bing's click-tracking redirect and a compromised WordPress site belonging to a South American retailer before landing on claude-desk-code.com, a fake Claude download page. Anthropic, Google and Microsoft were not involved; their services were abused.
How the scam works
The fake page shows Anthropic's real install command, but its copy button puts a different command on the clipboard. When pasted into the macOS Terminal, it prints a message claiming to download Claude, decodes a hidden address at lake-90.com, downloads a .dat file and runs it in the zsh shell. This copy-and-paste trick is called a ClickFix attack.
Two layers of cloaking hide the payload from scanners: visitors who go straight to the site get a 404 page. Push Security calls the ad technique "Adception" and tracks the toolkit as AcSig. The final payload was not identified.
Source
Geek Feed, "Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks" (October 13, 2026), citing Push Security.
Red flags
- Sponsored search results for software downloads.
- Install pages that ask you to paste a command into Terminal.
- A download site address that is not the vendor's own domain (Claude's is claude.ai).
If you were targeted
- 1Download software only from the vendor's own site, typed directly or bookmarked, not from ads.
- 2Before running any pasted command, check what was actually pasted.
- 3If you ran the command, disconnect from the internet, contact your IT team, and change passwords from another device.
- 4Report the ad to Google.