Fake Claude installer ads target Mac developers

Don't paste an install command you found through an ad. Not even when the page looks exactly like Claude's.

Push Security says a Google search ad for "claude mac" sent macOS users through a chain of redirects to a fake Claude download page, where the copy button swapped in a malicious command.

How the fake page got past a careful eye

Push researcher Luke Jennings laid out the chain on Oct. 9. The sponsored Google result showed bing.com as its address. A click went through Google's ad redirect, then Bing's own click-tracking redirect, then a real, indexed page on a compromised South American retailer's site, and finally to claude-desk-code[.]com, a polished copy of a Claude download page.

The page displays Anthropic's real install command, curl -fsSL https://claude.ai/install.sh | bash. The Copy button puts something else on your clipboard: a command that prints a legitimate-looking Claude address, then decodes a hidden one and pipes a remote script into the shell.

Push says a user who reads the page and watches the terminal would see a legitimate Claude URL both times.

The page also hides from researchers. It only serves the lure to visitors who arrive from Google or Bing, and the compromised site checks for a Bing referrer, according to Push.

Push tracks the toolkit as AcSig and lists eight lure domains in its report. It did not analyze what the final script does. BleepingComputer also reported the campaign.

Why AI coding tools are the bait now

This is a ClickFix attack: the victim runs the malware themselves by pasting a command. Push says "4 in 5 ClickFix attacks" reach victims through search engines, based on its own detection data.

The official installs for AI coding tools really are one-line terminal commands. Developers paste them without a second look. And the people searching "claude mac" usually have access to source code, cloud keys and production systems.

The bing.com label on a Google ad is the clever part. It turns the one check most people make, glancing at the domain, into false comfort.

What to do before your next install

Type the vendor's address yourself. For Claude, that is claude.ai or anthropic.com. Skip sponsored results for any developer tool.

Read what you paste. After copying an install command, paste it into a text editor first, not the terminal, and check every address in it. A command that decodes something, like a base64 string, before running it is a red flag.

If you manage a team, put this in front of them this week. Then check endpoint logs for the domains in Push's report.

If you already ran a command from a page like this, treat the machine as compromised and rotate the keys and tokens it held.

Google's ad display rules are the loophole

Watch whether Google stops ads that display one search engine's address while pointing somewhere else. Push's report shows that gap working today.

Bookmark the real download page. Use it every time.