Fraudulent Google Ads redirect users to fake Claude downloads

Hackers are using Google search ads that redirect through Bing's click-tracking system to lure users seeking Claude for Mac to install malware. They exploit Bing's trusted domain to evade ad security checks and ultimately direct victims to a fake Claude installer site. This page provides a command that looks legitimate but pastes malicious instructions, silently downloading and executing a harmful file on macOS systems.

• Attack uses Google ads with Bing redirects to evade detection
• Compromised WordPress sites forward traffic to a fake Claude page
• Cloaking techniques block direct scans and hide malware
• Fake page gives malicious macOS command for download
• Attack targets users searching for Claude Mac installer