CoolingSafety
Push Security: malvertising chain pushes fake Claude installer to macOS users
Push Security says a Google ad for "claude mac" showed bing.com as its domain, then passed through a Bing redirect and a compromised retailer site to a fake Claude download page. The page's copy button swaps in a command that pipes a remote script into zsh. Push tracks the toolkit as AcSig and lists eight related domains. The final payload was not identified.
- HEAT
- OUTLETS
- 1
- HACKER NEWS
- 20 pts
- FIRST SEEN
- LAST SIGNAL
Made the five · #4 on Sunday, October 11, 2026
Fake Claude installer ads target Mac developers
Primary source
Push Securitypushsecurity.com/blog/adception-malvertising-another-search-engines-search-resultsCoverage · 2 articles, oldest first
Saturday, October 10, 2026
bleepingcomputer.com20 pts on HN
Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksPush SecurityPrimary
Push Security: malvertising chain pushes fake Claude installer to macOS users