Clarissa Hana
Hackers are employing a sophisticated new malvertising technique, dubbed "Adception" by researchers at Push Security, to trick unsuspecting users into downloading malicious software. This campaign artfully abuses legitimate Bing search result redirects within Google search ads, aiming to deliver what is believed to be the ClickFix malware payload. The attackers’ strategy hinges on cloaking and exploiting trusted search engine domains to bypass security checks and lure victims through a multi-stage redirection process. The discovery of this campaign highlights a growing trend of adversaries using complex, layered approaches to compromise user systems, underscoring the ever-evolving landscape of online threats.
The genesis of this discovery can be traced to a specific incident detected by Push Security researchers. Their investigation began after identifying a deceptive Google advertisement that specifically targeted individuals searching for "claude mac." Claude, a popular AI assistant developed by Anthropic, has seen a surge in user interest, making its name a prime target for malicious actors seeking to exploit its popularity. The malicious ad, at first glance, appeared legitimate, prominently displaying the trusted "bing.com" domain as its destination. This tactic is a critical component of the Adception strategy, designed to disarm potential victims and advertising platform security mechanisms by leveraging the perceived trustworthiness of established search engines.
Unlike conventional malvertising operations that typically direct users to domains under the direct control of attackers, this campaign deviates significantly. The sponsored ad displayed on Google’s search results page presented the legitimate bing.com domain. This visual deception is crucial, as it significantly reduces the likelihood of a user flagging the ad as suspicious. The initial click on such an advertisement would typically initiate a chain of redirects, often processed by the advertising platform itself, before reaching the intended destination. In this instance, the chain was meticulously crafted to exploit this process.
Push Security’s detailed report outlines the intricate redirection flow. Upon clicking the seemingly innocuous Google ad, the user’s browser would first navigate through Google’s own advertising redirect mechanisms. Subsequently, the traffic would arrive at Bing’s bing.com/ck/a click-tracking endpoint. This endpoint, designed to monitor ad performance and user engagement, was then manipulated by the attackers. Instead of forwarding the user to a relevant Bing search result, it served as a pivot point, redirecting the browser to a legitimate, yet compromised, WordPress website. This compromised website, identified as belonging to a South American retailer, played a pivotal role in the multi-stage attack.
The compromise of the WordPress website was not arbitrary. Attackers likely identified it as a suitable platform due to its existing web presence and the potential for it to evade immediate detection. By routing traffic through this legitimate, albeit compromised, domain, the attackers further obfuscated their malicious intent. The compromised website then executed its part of the scheme, redirecting the visitor to claude-desk-code[.]com. This domain masqueraded as an official download page for Claude on macOS, meticulously designed to deceive users into downloading and executing malicious commands disguised as installation steps.
The technical underpinnings of this attack exploit the functionalities of Bing’s click-tracking redirects. These redirects commonly employ JavaScript to transmit visitors to their final destinations. This inherent flexibility allows malicious actors to hijack the process, rerouting unsuspecting users to their nefarious sites while maintaining the appearance that the traffic originates from a trusted source like Bing. This creates a significant challenge for security software that relies on analyzing traffic origins and destinations.
A key element of the Adception campaign is its robust implementation of cloaking techniques. The attackers employed multiple layers of obfuscation to prevent both automated security scanners and curious individuals from directly accessing the malicious payload. The compromised WordPress website, for instance, was configured to scrutinize incoming traffic. It specifically checked for a "Bing" referrer header and certain browser-specific headers. Only if these conditions were met would the website proceed with the redirection. This ensures that traffic originating from Bing search result clicks is prioritized, while direct access attempts or those from other sources are likely to be thwarted.
The fake Claude download page, claude-desk-code[.]com, also incorporated its own cloaking mechanisms. It utilized JavaScript to verify that visitors had arrived from either Google or Bing. This dual-layer verification process significantly enhances the campaign’s ability to evade detection. Visitors who attempted to access the malicious site directly, without following the carefully orchestrated redirect chain, were met with a benign 404 error page. This deliberate redirection to a non-existent page serves to mislead automated security scanners, making it far more challenging for them to discover and analyze the true nature of the attack. The attackers essentially force security researchers and automated tools into a digital dead end, protecting their malicious infrastructure.
The ultimate destination of this elaborate scheme is a deceptively convincing imitation of a legitimate Claude download page. This page presents users with what appears to be the official installation method for Claude on macOS, which involves executing a command in the Terminal. However, the sophistication of the attack is revealed in the subtle yet critical manipulation of this process. While the page displays Anthropic’s authentic installation command – curl -fsSL https://claude.ai/install.sh | bash – the act of copying this command to the clipboard is where the deception truly unfolds.
Instead of copying the legitimate command, the "copy" button on the fake page substitutes it with a malicious command. This substituted command initially prints a misleading message to the user, claiming to be downloading Claude from Anthropic’s official website. This provides a crucial moment of reassurance, as the user observes what appears to be the expected installation process in their Terminal. However, this is merely a smokescreen. The underlying malicious script then proceeds to decode a Base64-encoded URL. This URL points to lake-90[.]com, an attacker-controlled server.
From this server, the script uses curl to silently download a file with a .dat extension. The critical aspect here is that the contents of this downloaded file are piped directly into the macOS Z shell (zsh) for immediate execution. This means that the victim, while observing what they believe to be the legitimate Claude installation process, is unknowingly executing an entirely different and malicious script. The illusion is maintained by the fact that the legitimate Claude installation URL is visible both on the download page and within the terminal output, creating a powerful psychological diversion.
The precise nature of the final payload delivered by this attack remains unknown at the time of this report. This ambiguity is a common characteristic of such advanced persistent threats, where the initial compromise is designed to establish a foothold for later, more targeted or destructive actions. It is unclear whether the ultimate goal is to install further malware, steal sensitive data, or leverage the compromised system for other malicious purposes. The lack of definitive information on the payload underscores the importance of vigilance and prompt action by security professionals to identify and neutralize such threats.
Push Security’s analysis further indicates that this campaign is part of a broader operation. They have identified several other domains associated with the same ClickFix toolkit, which the researchers are tracking internally as "AcSig." These related domains exhibit identical characteristics, including the use of the same macOS installation command structure, a similar payload URL format, and an indistinguishable installer interface. This suggests a coordinated effort by a single threat actor or group, utilizing a well-established and refined toolkit for their malicious endeavors. The consistent application of these techniques across multiple discovered instances points to a deliberate and systematic approach to malvertising and malware distribution.
The implications of the Adception campaign are far-reaching. Firstly, it highlights the increasing sophistication of malvertising tactics, moving beyond simple malicious ads to intricate multi-stage redirection schemes that exploit trusted infrastructure. Secondly, the reliance on compromised legitimate websites as intermediaries demonstrates a growing trend of "supply chain" attacks in the advertising ecosystem, where the integrity of legitimate online entities is weaponized. This approach makes detection more challenging, as security tools may be hesitant to flag traffic originating from seemingly reputable domains.
The use of cloaking techniques, particularly those that differentiate between human visitors and automated scanners, represents a significant hurdle for security researchers. The ability of attackers to dynamically alter the user experience based on traffic origin and characteristics necessitates the development of more advanced detection and analysis methodologies. The fact that the fake Claude installer mimics legitimate commands and provides seemingly authentic output further erodes user trust in the visual cues they typically rely on to identify malicious software.
This incident also serves as a stark reminder of the vulnerabilities inherent in online advertising platforms and search engine result pages. While these platforms employ security measures, the constant evolution of attack vectors means that a perpetual cat-and-mouse game is underway. The ease with which attackers can inject deceptive ads and orchestrate complex redirection chains through seemingly legitimate channels raises concerns about the efficacy of current advertising security protocols.
In response to such evolving threats, security experts often advise users to exercise extreme caution when clicking on search ads, particularly for software downloads. Verifying the authenticity of download sources, scrutinizing URLs for any discrepancies, and relying on official vendor websites for software acquisition are paramount. Furthermore, maintaining up-to-date security software, including antivirus and anti-malware solutions, is crucial for detecting and mitigating known threats. The discovery of the Adception campaign underscores the need for continued research and development in cybersecurity to stay ahead of these increasingly sophisticated adversarial techniques. The ongoing battle against such advanced malvertising campaigns requires a multi-faceted approach, involving collaboration between security researchers, advertising platforms, and end-users to ensure a safer online environment.
