Fake Claude Downloads Use Google Ads to Trick Mac Users

Searching Google for software can lead you straight into a scam—even when the advertisement shows a familiar website.

Researchers at Push Security discovered an attack targeting people searching for “Claude Mac.” The sponsored result displayed Bing’s domain, but clicking it sent visitors through a compromised website and eventually to a fake Claude download page. Researchers called the technique “Adception.”

The fake page looked convincing and instructed users to install Claude through their Mac’s Terminal. The trick was in the copy button: the command shown on the page was legitimate, but clicking copy placed a different command on the clipboard.

Anyone who pasted and ran that command would download and execute a script from an attacker-controlled server. The Terminal also displayed a message referencing Claude’s official website, helping disguise what was happening.

The attackers also made the malicious page harder to investigate. Visitors arriving directly could see an error page, while people following the advertising route received the fake installer. BleepingComputer reported that the final payload remained unknown, so the exact malware involved had not been confirmed.

My takeaway: a sponsored search result and a professional-looking download page aren’t enough to earn your trust. Before running an installation command, verify the website and check what actually gets pasted into Terminal.

Source: Original reporting by Lawrence Abrams at BleepingComputer.