Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Hackers are using a technique called "Adception" that abuses Google Ads and Bing's redirect domains to distribute ClickFix malware disguised as fake Claude installers targeting macOS users. The attack exploits Bing's trusted domain in ad URLs to evade security checks, then uses multiple layers of cloaking and referrer verification to hide the malicious payload from security scanners. When victims click the ad and reach the fake Claude download page, a malicious command is substituted into the clipboard instead of the legitimate installation command.