Search ads for "claude mac" are sending Mac users to a fake installer. The ad shows a Bing address, not an attacker domain. BleepingComputer reported the Push Security findings on 9 October 2026. The payload at the end of the chain is still unknown.
What happened
Push Security calls the trick Adception. A Google ad uses Bing's click-tracking address as the destination so the ad looks trusted. After Google's own redirect, Bing forwards the browser to a compromised WordPress shop in South America, which sends the visitor to a fake Claude download page.
The page shows Anthropic's real install command. The copy button puts a different command on the clipboard. That command prints a line about downloading from Anthropic, then quietly fetches a script from an attacker server and pipes it into the Mac shell. Direct visits get a 404, so scanners that do not arrive from the ad often see nothing.
Who is affected
- Staff who search for Claude, or any new desktop AI tool, and install from the first sponsored result.
- Mac users in particular. This lure copies a Terminal one-liner, which is exactly how the real Claude Mac install is documented.
- Anyone who treats a bing.com address in an ad as proof the destination is safe. The trusted domain is only the first hop.
What to do now
Install Claude only from Anthropic's own site, and never paste a command from a download page that arrived via an ad. If someone already ran it, isolate the Mac and look for an unexpected shell child of Terminal and outbound calls that were not part of a normal install. Block the fake download pattern in web filtering, and tell the service desk that a sponsored result is not a vendor page.
Source: BleepingComputer, 9 October 2026, citing Push Security. Read the report.
Also on the blog
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Edward Dubrovsky arrested in Pennsylvania extortion case
- Nippon Columbia malware exposed 8.63 million karaoke records
- FortiBleed still holds 86,644 Fortinet device credentials
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.