Summary
Hackers are abusing Google Ads and Bing search redirects to deliver a ClickFix malware campaign that uses Claude branding as its social engineering lure. Victims searching for Claude or AI assistant tools are served malicious advertisements or redirected through Bing links to pages impersonating Anthropic’s Claude product, where a ClickFix prompt instructs them to paste a PowerShell command to “activate” or “install” Claude. The PowerShell command downloads and executes malware. The campaign combines search advertising abuse with AI brand impersonation and the ClickFix social engineering technique documented in TTO-2026-0930-189.
Timeline
| Date | Event |
|---|---|
| Sep 30, 2026 | ClickFix via Custom GPT documented; TTO-2026-0930-189 published |
| Oct 10, 2026 | Google Ads and Bing redirect abuse delivering Claude-themed ClickFix campaign confirmed; BleepingComputer reports |
What Happened
The campaign targets users actively searching for Claude or AI assistant software — a population with high intent to install software and high baseline trust in AI product interfaces. By abusing Google Ads and Bing redirect infrastructure, attackers place malicious results at or near the top of search results for Claude-related queries, reaching users at the precise moment of maximum intent and minimum skepticism. The Claude-branded ClickFix page presents a convincing fake installation or activation interface that instructs users to open a terminal and paste a PowerShell command.
This campaign is more dangerous than the Custom GPT ClickFix variant documented in TTO-2026-0930-189 because it reaches users before they have any interaction with a real AI system. A user who arrives at a fake Claude page via a Google ad has no prior conversation context to draw on — the entire trust basis is the Google/Bing ad placement and the Claude branding. The combination makes the social engineering highly effective. Users should only download Claude from anthropic.com directly and treat any search advertisement for AI software with elevated skepticism.
Note on Domain Intelligence
This bulletin covers abuse of Google Ads and Bing redirect infrastructure. The primary subject is the malware campaign, not Google or Microsoft as organizations.