Fake Claude search ad: a Bing domain and a substituted command

On 9 October, Push Security described a campaign beginning with a Google ad for a search for “claude mac”. The ad displayed a Bing domain, while redirects passed through a compromised retailer’s website to a fake Claude installer. The researchers named this variant Adception. The observed scenario targeted macOS users. Source: the Push Security investigation.

The fake page’s copy button substituted the displayed installation command with one executing an attacker script, the researchers report.

Breachroad’s conclusion: organisations should provide a straightforward route to approved software and to reporting unusual installation instructions. Recognising a familiar domain at the first stage is insufficient to assess the complete path. The actions below are our recommendations for employees and IT teams.

Focus on the requested action

Pay attention when a page asks you to open a terminal and execute copied content. In our plan, that instruction needs verification outside the advertisement itself. A message about downloading a popular AI tool does not replace authorisation to install software on a work computer.

Do not establish authenticity from a logo, a button’s appearance or a message printed by a script. Users need to know where their organisation supplies approved tools and who answers questions. This matters for technical staff who use terminals in their everyday work as well.

While the suspicious page is still open

We recommend stopping the task and following no further instructions. Record the visible page address, approximate time and how you reached it. If you can preserve a screenshot without further interaction, include it in your internal report.

Distinguish three stages in the description: opening the page, copying content and executing it. Responders need the actual sequence, including where the employee is unsure of details. Do not revisit the page simply to reconstruct the suspicious command or click the button again.

Do not send clipboard contents or terminal history to an arbitrary analysis tool. They may contain information from other tasks. Use your approved reporting channel and establish with IT which evidence is needed.

If the command was executed

In our plan, the employee reports immediately, identifies the device and account used and follows the response team’s instructions. They should avoid trying to repair the situation with another script from the internet. Further decisions should reflect the process’s actual actions and the account’s permissions.

We recommend that IT assesses available device events, connections and changes, preserves relevant evidence and decides on isolation and recovery. Password and session changes should reflect the established incident scope. Closing the terminal does not explain what a downloaded script previously did.

What the organisation should prepare

We suggest three concrete arrangements:

1. A download route. Give employees an approved way to install AI tools. It should be easy to locate even for someone using the application for the first time.
2. An exception process. Identify who evaluates a tool missing from the catalogue and where unusual instructions are reported. Employees need a way to complete their task without improvising an installation.
3. Report handling. Prepare questions about the time, device and actions taken. Prompt reporting should help establish scope without requiring users to diagnose the threat themselves.

Technical restrictions and event recording support this procedure. In our assessment, education works best when employees know the practical next step and can use it while carrying out everyday work.

An exercise without executing commands

During training, show a fictional ad, an example download page and a message asking the user to open a terminal. Ask participants where they would stop and what they would report to IT. This is our suggested knowledge exercise; it does not require visiting campaign domains or running scripts.

For broader context, read our guide to phishing awareness and layers of defence. To practise these decisions with employees, explore our cybersecurity training for organisations.