Insights Security & Privacy
Fake Claude ads on Google trick Mac users into running harmful commands
The short version
Researchers found a Google ad for Claude that led to a fake download page. The page quietly swaps the install command you copy for a harmful one. Going to the official site yourself is safer.
What happened
Security firm Push Security spotted a sponsored Google result for people searching "claude mac". The ad showed bing.com as its address, which made it look trustworthy. Behind it, the click passed through a hacked retailer's website and ended on a fake Claude download page.
The page shows the real install command, but the copy button puts a different one on your clipboard. Pasted into Terminal, the Mac's command window, it prints a message claiming to download from Anthropic's website, while fetching and running a hidden script from another server.
The fake page also hides itself. Opening its address directly gives an error page, which makes it harder for security tools to find. Researchers have not worked out what the final payload is.
Why it matters to you
A sponsored result is not proof that a site is safe, even when the address looks familiar. Here, the page, the command on screen and the Terminal message all looked genuine, so checking by eye could easily miss it.
The same trick is used to impersonate other popular tools. Anyone who searches for an AI app and follows install steps from a web page could be caught, including people who rarely use Terminal.
What to do
Type the official address of the tool, such as claude.ai, into your browser yourself, or use a bookmark. Do not click sponsored results for software downloads.
Never paste commands from a web page into Terminal or the Windows Run box unless you fully trust and understand them. If you already ran such a command, disconnect from the internet, change your important passwords from another device, and ask an IT professional to check the computer.
Sources
- Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks BleepingComputer (opens in a new tab)
- Analyzing AI-themed ClickFix, InstallFix & LLMshare attacks Push Security (researchers' own report) (opens in a new tab)
- Hackers Use Google Ads and Bing to Spread Fake Claude Installers Windows Report (opens in a new tab)
Researched and written by our automated news system.
Free website check
Is your own website in good shape?
Get a score out of 100 for speed, security, Google visibility and trust in about 30 seconds, with the three things most worth fixing. Free, and no email needed.