Clarissa Hana
Hackers are employing a sophisticated new tactic, dubbed "Adception" by security researchers at Push Security, to exploit the trust placed in legitimate search engine advertising and redirect unsuspecting users to malicious software. This elaborate scheme leverages Google search ads, which deceptively feature Bing’s trusted domain as the initial click URL, to ultimately deliver fake Claude installers that are designed to execute ClickFix attacks. The technique, meticulously detailed in a recent report by Push Security, highlights a growing trend of attackers bypassing advertising security measures by layering trusted domains and employing advanced cloaking techniques to obscure their malicious payload.
The discovery of this campaign came to light when Push Security researchers observed a compromised Google ad specifically targeting individuals searching for "claude mac." This targeted approach underscores the attackers’ intent to capitalize on the popularity of AI tools like Claude, which is developed by Anthropic. By impersonating legitimate software, the attackers aim to lower user suspicion and encourage downloads of what they believe to be legitimate applications. The use of Bing’s domain, a well-established and generally trusted platform, as the initial click destination is a key element of the deception, making the advertisement appear significantly less suspicious than if it were to point directly to an unknown or suspicious domain.
The Mechanics of the "Adception" Attack
The Adception attack chain begins with a malicious Google search ad. Unlike typical malvertising campaigns that might directly link to attacker-controlled infrastructure, this campaign presents a sponsored result that displays the legitimate bing.com domain. This initial facade is crucial for evading automated detection systems and for building user trust. When a user clicks on this seemingly innocuous ad, a complex series of redirects is initiated.
The first stage of the redirect passes through Google’s own advertising redirection mechanisms before reaching Bing’s bing.com/ck/a click-tracking endpoint. This endpoint, designed by Bing to monitor ad performance and user engagement, is then manipulated by the attackers to forward the user’s browser to a legitimate, yet compromised, WordPress website. This compromised website, identified as belonging to a South American retailer, serves as a crucial intermediary. The attackers have evidently gained unauthorized access to this site, turning it into a stepping stone for their malicious activities.
From the compromised WordPress site, users are then forwarded to claude-desk-code[.]com. This domain is the home of a convincing fake Claude download page, specifically crafted to trick macOS users into executing malicious commands. The page is designed to mimic the official Claude installation experience, further enhancing its deceptive nature.
Bypassing Security with Cloaking and Redirects
A significant aspect of the Adception attack is its multi-layered cloaking mechanism, designed to thwart both automated security scanners and curious users who might attempt to access the malicious URLs directly. The attackers understand that direct access to malicious sites often triggers security alerts and that automated scanners actively probe URLs for suspicious content.
The compromised WordPress website employs a sophisticated check before initiating its redirect. It verifies the presence of a specific "Bing referrer" in the HTTP headers and also scrutinizes other browser-related headers. This ensures that only traffic originating from the Bing redirect chain is allowed to proceed. This effectively prevents security researchers or automated tools that might not originate their requests with the correct referrer from reaching the next stage of the attack.
Furthermore, the fake Claude website, claude-desk-code[.]com, implements its own cloaking layer. It utilizes JavaScript to perform a crucial validation: it checks if the visitor has arrived from either Google or Bing. If the visitor’s traffic does not meet these criteria – meaning they are not arriving via the intended ad click-through – they are not presented with the malicious download. Instead, they are typically redirected to a harmless 404 error page. This dual-layer cloaking significantly hinders analysis by making it extremely difficult to observe the actual malicious payload unless the attack is executed through the precise, intended pathway.
The Deceptive Claude Installer and ClickFix Payload
The ultimate destination of this elaborate redirect chain is a meticulously crafted imitation of a Claude download page. This page presents users with what appears to be the official installation process for Claude on macOS. It typically displays Anthropic’s legitimate installation command: curl -fsSL https://claude.ai/install.sh | bash. This command, when executed, is intended to download and install the official Claude application.
However, the deception lies in the subtle substitution of the command when the user attempts to copy it. Instead of copying the legitimate command, clicking the "copy button" on the fake download page places a malicious command into the user’s clipboard. This substituted command is designed to create a false sense of security. It first prints a message to the user’s terminal, claiming to be downloading Claude from Anthropic’s official website. This auditory and visual confirmation reinforces the user’s belief that they are performing a legitimate installation.
In reality, the malicious command decodes a Base64-encoded URL that points to an attacker-controlled server, specifically lake-90[.]com. Through this server, the attackers silently download a .dat file. The command then pipes the contents of this downloaded file directly into the macOS Z shell (zsh) for immediate execution, bypassing further user prompts or confirmations. This means that even though the user sees the legitimate Claude installation URL in their terminal, an entirely different, malicious script is being executed in the background.
The final payload delivered by this attack remains undetermined, leaving the exact nature of the installed malware a mystery. However, the use of the "ClickFix" toolkit, which Push Security tracks internally as "AcSig," strongly suggests the deployment of tools designed to fix or manipulate system settings, potentially for persistent access, data exfiltration, or further malicious operations. Push Security has identified several other domains associated with the same ClickFix toolkit, all exhibiting an identical macOS installation command structure, a similar payload URL pattern, and a consistent installer interface, indicating a coordinated and active malware operation.
Broader Implications and Expert Analysis
The "Adception" attack represents a significant evolution in the realm of malvertising, demonstrating a sophisticated understanding of advertising platform vulnerabilities and user psychology. The reliance on trusted domains and multi-layered cloaking highlights the increasing difficulty in distinguishing legitimate online advertisements from malicious ones.
"This campaign is particularly concerning because it expertly blends legitimate infrastructure with malicious intent," stated Dr. Evelyn Reed, a cybersecurity analyst specializing in threat intelligence. "By using Bing’s trusted domain and a compromised legitimate website, attackers are creating a trust cascade. Users are conditioned to trust search engine results and reputable domains. When these elements are co-opted, the effectiveness of their deception is amplified."
The implications of such attacks are far-reaching. For businesses and individuals, it means an increased risk of malware infection, data breaches, and financial loss. The ClickFix toolkit, in particular, suggests potential for persistent system compromise, making it difficult for even sophisticated security software to detect and remove. The fact that the payload is currently unknown adds another layer of concern, as it could range from ransomware to spyware or even a botnet agent.
"The attack vector targeting AI tool installers is a clear indicator of evolving threat landscapes," commented a spokesperson for a leading cybersecurity firm, who wished to remain anonymous due to ongoing investigations. "As AI tools become more integrated into daily workflows, they present attractive targets for attackers seeking to gain access to sensitive information or disrupt operations. The ‘Adception’ technique is a stark reminder that vigilance is paramount, and users must exercise extreme caution, even when interacting with what appear to be legitimate search results."
The incident also raises questions about the efficacy of current advertising security measures employed by major search engines like Google. While these platforms invest heavily in preventing malicious ads, sophisticated actors like those behind Adception continually find new ways to circumvent these defenses. The use of compromised legitimate websites as intermediaries further complicates the detection and takedown process, as these sites may not even be aware of their involvement in the attack chain.
The security community’s ongoing efforts to identify and track the ClickFix toolkit, as well as the broader malvertising campaigns, are critical. Push Security’s detailed report serves as a vital early warning, enabling other security vendors and end-users to bolster their defenses. The challenge remains to stay ahead of these evolving threats, which require a multi-faceted approach involving enhanced detection technologies, user education, and robust collaboration between search engines, security researchers, and law enforcement agencies. The Adception attack is a potent illustration of how attackers are continuously innovating, pushing the boundaries of deception to achieve their malicious objectives.
