Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks
-
Attackers are abusing legitimate Bing search-result redirects as click URLs within Google search ads, using them to funnel victims toward fake Claude installers that deliver ClickFix attacks. Because the ad links ultimately point to a trusted Microsoft domain, they can slip past Google's ad review and lend an air of legitimacy to the malicious landing pages.
The chain works like this:
- Victims see sponsored Google ads related to Claude, Anthropic's AI assistant.
- Clicking the ad routes them through a genuine Bing redirect, which then sends them to a lookalike installer page.
- That page serves a ClickFix prompt, social-engineering users into running malicious commands themselves, often pasted into the Windows Run dialog under the guise of "fixing" or "verifying" the software.
Users searching for AI tools should treat sponsored results with suspicion, especially when the "download" flow asks them to paste and execute commands instead of downloading a normal installer. Verifying the destination domain and going directly to the vendor's official site remains the safest route.
Source: BleepingComputer
Has anyone in the community spotted similar ClickFix lures abusing trusted redirect chains, and how is your organization defending against them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login