Cybersecurity experts at Push Security have identified a sophisticated scam targeting Mac users searching for Claude AI. The attack leverages Google ads and Bing redirects to lead victims to a fraudulent download site that executes malicious scripts via the macOS Terminal.
The Google-to-Bing pipeline to a South American retailer
The attack begins with a sposnored search result on Google that appears to lead to bing.com, a domain owned by Microsoft. According to Push Security, this is a calculated move to lend the advertisement an air of legitimacy. Once a user clicks, they are routed through Bing's own click-tracking service, which then forwards the browser to a compromised WordPress website belonging to a retailer in South America.
This compromised retailer site acts as a final gateway, sending the visitor to a fraudulent domain: claude-desk-code[. ]com. By the time the user arrives at this fake Claude download page, the chain of redirects has effectively masked the malicious nature of the destination, making the site appear as a legitimate extension of the search process.
How the 'Copy' button hides Base64 encoded scripts
Once on the fake download page, Mac users are presented with an installation command that looks like it originated from Anthropic, the company that develops Claude. However, the page employs a deceptive clipboard trick. While the screen displays a harmless-looking command, clicking the "Copy" button actually places a completely different, malicious command onto the user's clipboard.
As Push Security reported, this substituted command uses Base64 encoding to hide a URL controlled by the attackers. When the victim pastes and runs this command in the Mac Terminal, the system displays a fake message claiming the software is being downloaded from the official Anthropic site. In reality, the command decodes the hidden address, downloads a remote script, and executes it directly within the Mac's Z shell.
The AcSig toolkit and the use of cloaking
The attackers are utilizing a specific malicious toolkit that Push Security tracks as "AcSig." This toolkit includes a feature known as "cloaking," which allows the fake Claude website to identify where a visitor is coming from. If the website detects that a visitor arrived directly—rather than through a Google or Bing redirect—it displays a 404 error page instead of the malicious installer.
This cloaking mechanism is designed to thwart security researchers and automated scanners. By hiding the payload from anyone not following the specific "Adception" path, the attackers ensure that the fraudulent infrastructure remains active longer by avoiding detection from standard security audits.
The evolution of InstallFix and ClickFix scams
This campaign is part of a broader trend in social engineering known as "InstallFix," a variant of the "ClickFix" technique. These scams shift the burden of infection from the software to the user, tricking people into manually executing dangerous commands under the guise of troubleshooting or software installation. By convincing the user to run the code themselves, the attackers can often bypass traditional browser security warnings.
The use of trusted search infrastructure to facilitate these attacks represents a growing risk.. When attackers can chain together the advertising systems of Google and the redirect services of Microsoft,they create a "trust bridge" that makes even technically confident users vulnerable to executing untrusted code in their Terminal.
The mystery of the final AcSig payload
Despite the detailed mapping of the delivery chain,a critical piece of the puzzle remains missing. Push Security's published findings do not identify the final payload or the specific actions the downloaded script takes once it gains access to the Mac's Z shell.
Because the script runs with the permissions of the user who executed the command, the potential for damage is significant. Whether the payload is designed for data exfiltration, credential theft, or the installation of persistent ransomware remains unverified, leaving a dangerous gap in the current understanding of the AcSig toolkit's ultimate goal.
Comments 0