Hackers hide dangerous fake AI downloads behind Google ads
Hackers used a Google sponsored result to direct people searching for Claude for Mac to a convincing fake download page. The campaign matters because it combines trusted looking search links with a deceptive installer to trick users into running a harmful command on their Mac.
Push Security researchers found that the ad showed Bing’s legitimate domain, then routed visitors through Bing’s click tracking and a compromised WordPress site before reaching the fake page. The site, claude-desk-code[.]com, was designed to appear only to visitors arriving through the expected route, a tactic known as cloaking. The supplied article text ends before explaining how the installer’s displayed command differs from the command it secretly copies.
- A Google ad sent Claude for Mac searches towards a fake download page.
- Bing redirects and a compromised retailer’s website obscured the destination.
- Researchers say the page was set up to evade casual checks.