Hackers are abusing legitimate Bing search-result redirects as click URLs in Google search ads to direct users to fake Claude installers that deliver ClickFix attacks.
The technique, dubbed "Adception" by security researchers at Push Security, appears designed to evade advertising security checks by using Bing's trusted domain as the ad destination, before redirecting victims through a compromised website to the malicious download page.
The attack also uses multiple layers of cloaking to prevent security scanners and visitors who access the malicious URLs directly from seeing the payload.
According to a report published by Push Security, the campaign was discovered after researchers detected a malicious Google ad targeting users searching for "claude mac."
Source: Push Security