The Claude ClickFix attack used a Google sponsored result that displayed a trusted Bing address but led macOS users to a counterfeit Claude installer. Documented by Push Security and BleepingComputer on October 9, 2026, the page showed Anthropic’s real installation command while its Copy button placed a different command on the clipboard. The final downloaded payload was not identified.
What is the Claude ClickFix attack?
A Claude ClickFix attack is a social-engineering technique that persuades users to copy and run attacker-controlled shell commands under the guise of installing Anthropic’s Claude software. The October 2026 campaign combined a deceptive sponsored result, cross-platform redirect tracking, referrer checks and clipboard substitution to reach macOS users.
Push Security detected the campaign through browser telemetry in a customer environment and published its investigation on October 9, 2026. The company calls the cross-search-engine redirect technique “Adception” and tracks the shared ClickFix page toolkit internally as “AcSig.” Those names describe the delivery mechanics, not a confirmed malware family.
The distinction matters. Push Security and BleepingComputer reported no identified final payload, reliable victim total or financial-loss figure in 2026. Claims that the campaign installed a particular infostealer, backdoor or ransomware strain would therefore go beyond the published evidence.
ClickFix attacks transfer a critical step to the victim: you execute the command yourself. That approach can sidestep some expectations around downloaded applications because the initial action occurs in Terminal rather than through a conventional installer package.
How did fake Claude ads exploit Google and Bing redirects?
The Claude ClickFix attack began with a Google sponsored result for “claude mac” that displayed bing.com as the apparent destination. On October 9, 2026, investigators traced the request through Google ad tracking, Bing click tracking, a compromised WordPress page and finally the counterfeit domain claude-desk-code[.]com.
The observed chain contained four distinct trust transitions. Each destination gave the next request enough context to pass another filter, making the route harder to reproduce by opening the final address directly.
| Stage | Observed host or path | Documented behavior in 2026 |
|---|---|---|
| Google ad click | google.com/aclk |
Sent the browser toward a Bing tracking address shown in the sponsored result. |
| Bing click tracker | bing.com/ck/a |
Returned JavaScript that forwarded the browser and supplied a Bing referrer. |
| Compromised website | homeopatiaalemana[.]com/quienes-somos/ |
Checked the Bing referrer and selected browser headers before redirecting. |
| Counterfeit installer | claude-desk-code[.]com |
Required a Google or Bing referrer; other requests received an HTTP 404 response. |
Push Security decoded a timestamp in the Bing tracking link as October 5, 2026, probably the date Bing generated that link. Its report identified the intermediary as a compromised South American retailer’s WordPress page. A legitimate site becoming a disposable redirector is also a reminder that rogue WordPress administrator access can have consequences far beyond the original site.
Bing’s involvement didn’t mean Microsoft hosted the counterfeit installer. The bing.com/ck/a endpoint supplied a recognizable domain and a Bing referrer, while the compromised page and final site used that context to decide who saw the lure. Push Security’s “Adception” label captures the key trick: one search engine’s advertising path appeared to borrow trust from another search engine’s tracking infrastructure.
Why did the counterfeit Claude installer look legitimate?
The counterfeit Claude installer displayed Anthropic’s genuine macOS and Linux command, curl -fsSL https://claude.ai/install.sh | bash, which Anthropic’s documentation listed as its recommended native installation command in October 2026. The visible text was accurate, but the page’s Copy button silently placed different code on the clipboard.
According to the October 2026 investigations, the substituted command printed a reassuring Claude download message, decoded an encoded URL, fetched data from lake-90[.]com and piped the result to zsh. BleepingComputer identified that domain after decoding the clipboard content. Researchers did not establish what the remote server ultimately delivered.
The overlooked pitfall is simple: reading the command on a web page doesn’t verify the command you copied. A website can use JavaScript to write arbitrary text to the clipboard, so visual inspection before clicking Copy provides no assurance about what will reach Terminal.
There is an awkward counterpoint. Anthropic’s authentic 2026 installation method also downloads a script and sends it directly to a shell, so curl | bash isn’t automatically proof of compromise. Context decides the risk: the source page, destination domain, clipboard contents and correspondence with the vendor’s bookmarked documentation must all agree.
How can you check a copied Claude command safely?
You can inspect a copied Claude command without executing it by pasting into a non-executing plain-text editor, viewing Clipboard history in macOS Tahoe, or running pbpaste in Terminal. In 2026, encoded strings, unrelated domains and download-to-shell pipelines warrant investigation before you approve any Claude installation.
Use the following checks in order, stopping if the copied text differs from Anthropic’s official documentation:
- Open Claude documentation from a bookmark or type the known vendor address yourself rather than returning through a sponsored result.
- Copy the command, then paste it into a plain-text editor that won’t execute shell syntax. Compare every domain, option, pipe and shell name.
- On macOS Tahoe, review recent copied text through Clipboard history in Spotlight, a feature Apple documented on August 24, 2026.
- Alternatively, enter
pbpasteto print the clipboard contents. Displaying clipboard text does not execute the text it contains. - Stop if you see Base64 decoding, an unrelated host such as
lake-90[.]com, or a command that downloads remote content and immediately sends it tozshorbash.
Apple advised on June 15, 2026, that users shouldn’t override Terminal paste warnings unless they understand the command and trust its source. That warning is a decision point, not nuisance UI. Honestly, bypassing it only because an advertisement looked polished defeats the protection.
Apple’s August 3, 2026 security documentation says macOS 26.4 or later adds Terminal paste warnings, XProtect inspection of process trees created by pasted commands and network-artifact checks against Apple’s Safe Browsing service. Those controls may catch suspicious behavior, but they don’t make an unverified command safe.
How should organizations block and detect the Claude ClickFix attack?
Organizations should reduce Claude ClickFix attack exposure by allowing software installs only from bookmarked vendor documentation, managed catalogs or approved package repositories. Detection should correlate ad clicks, Bing tracking requests, unexpected WordPress redirects, referrer-dependent responses, lookalike domains, encoded commands and shell processes that download and immediately execute remote content.
A single event may look ordinary. Google ad-click traffic is common, Bing’s /ck/a path is legitimate tracking infrastructure, and an HTTP 302 response from WordPress isn’t inherently hostile. The useful signal comes from sequence and timing: ad click, cross-engine tracker, unrelated site, lookalike domain, clipboard-driven shell and outbound retrieval.
Security teams can test suspected cloaking by comparing requests with and without Google or Bing referrers and by changing browser headers in a controlled environment. In the observed October 2026 campaign, direct access to the counterfeit site returned HTTP 404 unless the required search-engine context was present. That discrepancy is detection evidence, not proof by itself.
WordPress operators should investigate unexplained redirects from ordinary content pages, unauthorized administrator accounts, modified plugins and injected JavaScript. Similar discipline applies to software supply chains: dependency controls for AI-assisted development help keep acquisition paths explicit rather than leaving developers to trust search results.
For managed Macs, restrict Terminal and shell execution for users who don’t need them. Developers who do need shell access should receive approved installation instructions through internal documentation or a software catalog. Runtime restrictions are more dependable than policy alone, a principle also reflected in AI governance enforced through technical controls.
Attribution should remain conservative. The redirect path, clipboard substitution and remote domain were documented in 2026; the final malware family was not. Blocking the infrastructure is justified, but naming an unconfirmed payload can contaminate incident records and send responders hunting for the wrong indicators.
Claude ClickFix attack FAQ
Was Anthropic’s real Claude installer compromised?
No compromise of Anthropic’s official installer was reported in the October 2026 investigations. The counterfeit page displayed Anthropic’s genuine command, but its Copy button substituted a different clipboard command.
Did Bing host the fake Claude download?
Bing did not host the counterfeit Claude installer in the documented 2026 chain. Bing’s legitimate bing.com/ck/a tracking endpoint forwarded the browser to a compromised WordPress page, which then redirected selected visitors elsewhere.
What malware did the fake Claude ad install?
No final malware family was identified by Push Security or BleepingComputer as of October 9, 2026. The substituted command retrieved remote data, but published reporting did not establish the resulting payload or its behavior.
Is every curl-to-bash command malicious?
No. Anthropic’s official 2026 documentation itself recommended a curl | bash installation command for Claude, but any download-to-shell pipeline carries risk because code executes immediately. Verify the source, copied text and destination domain before running it.