Fake Claude downloads use Bing redirects to conceal malicious Google ads

Attackers are routing Google search ads through legitimate Bing redirects to send macOS users to fake Claude download pages, security researchers at Push Security found. The campaign uses Bing's trusted domain as the advertised destination, then passes visitors through a compromised retailer's WordPress website. The fake installer displays Anthropic's legitimate installation command, but its copy button substitutes a command that downloads and executes an attacker-controlled script. Checks for referral information and browser headers hide the malicious page from direct visitors and security scanners. The final payload remains unknown, leaving researchers unable to establish what malware, if any, the script installs.