Hackers Use Google Ads and Bing Redirects to Spread Mac Malware
Attackers leverage trusted search platforms to trick users into executing malicious terminal commands.
1The Adception Attack Mechanism
Security researchers at Push Security identified a sophisticated campaign dubbed Adception. Attackers purchase Google ads that display legitimate Bing URLs to gain user trust. Clicking these ads triggers a series of redirects through compromised WordPress sites, eventually landing victims on a fake Claude AI download page designed to harvest system access.
2Cloaking Bypasses Security Scanners
The malicious infrastructure employs cloaking to evade detection by security scanners. The fake website checks the visitor's origin, showing a 404 error if the traffic does not arrive from specific search engines. This ensures that automated security tools often encounter harmless pages while real victims are directed to the dangerous installer.
3Deceptive Clipboard Substitution Tactics
The fake Claude site displays a seemingly legitimate installation command to the user. However, clicking the copy button triggers a script that replaces the text with a malicious Base64 encoded command. When pasted into the macOS Terminal, this hidden code executes a remote script directly within the user's Z shell environment.
4Exploiting User Trust in Search
This attack relies on the perceived safety of sponsored search results. By routing traffic through Bing’s legitimate click-tracking service, attackers mask their true destination. Users are conditioned to trust results appearing at the top of Google, making them less likely to scrutinize the complex redirect path leading to the fake installer.
5The Role of InstallFix Techniques
The campaign utilizes a variation of the ClickFix technique, which researchers track as AcSig. By convincing users to manually execute commands, attackers bypass traditional software sandboxing. The malicious script runs with the user's full permissions, potentially allowing for unauthorized file modifications, data theft, or the installation of additional persistent malware payloads.
6Platform Response and Mitigation
Google has suspended the advertiser accounts associated with this campaign, citing policy violations regarding malware distribution. Microsoft confirmed that its Defender protections identify the malicious indicators found in the report. Despite these platform-level interventions, the researchers emphasize that the attackers' ability to evolve their cloaking tactics remains a significant ongoing threat.
7Best Practices for Secure Downloads
Users should avoid clicking sponsored search results for software downloads. Instead, navigate directly to the developer's official website to obtain installers. If a site requests that you copy and paste a command into the Terminal, treat it as a high-risk activity and verify the instructions with the official software provider first.
8Verifying Clipboard Contents Safely
Before executing any command copied from a website, paste the text into a plain-text editor first. This allows you to inspect the code for hidden Base64 strings, unexplained web addresses, or suspicious remote execution scripts. If the command does not match the visible instructions on the page, do not run it.
9Implications for Digital Security
This incident highlights the limitations of relying solely on domain reputation when clicking search ads. As attackers increasingly weaponize legitimate infrastructure like Bing redirects, professional vigilance is required. If you have already executed such commands, assume your system is compromised and perform a thorough security audit or restore from a clean backup.