<![CDATA[Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks]]>Attackers are abusing legitimate Bing search-result redirects as click URLs within Google search ads, using them to funnel victims toward fake Claude installers that deliver ClickFix attacks. Because the ad links ultimately point to a trusted Microsoft domain, they can slip past Google's ad review and lend an air of legitimacy to the malicious landing pages.

The chain works like this:

  • Victims see sponsored Google ads related to Claude, Anthropic's AI assistant.
  • Clicking the ad routes them through a genuine Bing redirect, which then sends them to a lookalike installer page.
  • That page serves a ClickFix prompt, social-engineering users into running malicious commands themselves, often pasted into the Windows Run dialog under the guise of "fixing" or "verifying" the software.

Users searching for AI tools should treat sponsored results with suspicion, especially when the "download" flow asks them to paste and execute commands instead of downloading a normal installer. Verifying the destination domain and going directly to the vendor's official site remains the safest route.

Source: BleepingComputer
Has anyone in the community spotted similar ClickFix lures abusing trusted redirect chains, and how is your organization defending against them?

]]>https://xploitlk.com/topic/629/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacksRSS for NodeTue, 27 Oct 2026 07:51:40 GMTFri, 09 Oct 2026 22:30:17 GMT60