# Hackers Use Google Ads and Bing Redirects to Spread Mac Malware Attackers leverage trusted search platforms to trick users into executing malicious terminal commands. - **Source:** [Technology News Articles on Fox News](https://www.foxnews.com/tech) - **Published:** 2026-10-17 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/02e95950-92e1-402f-81d1-9e900aaf1192 ## The Adception Attack Mechanism Security researchers at Push Security identified a sophisticated campaign dubbed Adception. Attackers purchase Google ads that display legitimate Bing URLs to gain user trust. Clicking these ads triggers a series of redirects through compromised WordPress sites, eventually landing victims on a fake Claude AI download page designed to harvest system access. ## Cloaking Bypasses Security Scanners The malicious infrastructure employs cloaking to evade detection by security scanners. The fake website checks the visitor's origin, showing a 404 error if the traffic does not arrive from specific search engines. This ensures that automated security tools often encounter harmless pages while real victims are directed to the dangerous installer. ## Deceptive Clipboard Substitution Tactics The fake Claude site displays a seemingly legitimate installation command to the user. However, clicking the copy button triggers a script that replaces the text with a malicious Base64 encoded command. When pasted into the macOS Terminal, this hidden code executes a remote script directly within the user's Z shell environment. ## Exploiting User Trust in Search This attack relies on the perceived safety of sponsored search results. By routing traffic through Bing’s legitimate click-tracking service, attackers mask their true destination. Users are conditioned to trust results appearing at the top of Google, making them less likely to scrutinize the complex redirect path leading to the fake installer. ## The Role of InstallFix Techniques The campaign utilizes a variation of the ClickFix technique, which researchers track as AcSig. By convincing users to manually execute commands, attackers bypass traditional software sandboxing. The malicious script runs with the user's full permissions, potentially allowing for unauthorized file modifications, data theft, or the installation of additional persistent malware payloads. ## Platform Response and Mitigation Google has suspended the advertiser accounts associated with this campaign, citing policy violations regarding malware distribution. Microsoft confirmed that its Defender protections identify the malicious indicators found in the report. Despite these platform-level interventions, the researchers emphasize that the attackers' ability to evolve their cloaking tactics remains a significant ongoing threat. ## Best Practices for Secure Downloads Users should avoid clicking sponsored search results for software downloads. Instead, navigate directly to the developer's official website to obtain installers. If a site requests that you copy and paste a command into the Terminal, treat it as a high-risk activity and verify the instructions with the official software provider first. ## Verifying Clipboard Contents Safely Before executing any command copied from a website, paste the text into a plain-text editor first. This allows you to inspect the code for hidden Base64 strings, unexplained web addresses, or suspicious remote execution scripts. If the command does not match the visible instructions on the page, do not run it. ## Implications for Digital Security This incident highlights the limitations of relying solely on domain reputation when clicking search ads. As attackers increasingly weaponize legitimate infrastructure like Bing redirects, professional vigilance is required. If you have already executed such commands, assume your system is compromised and perform a thorough security audit or restore from a clean backup. ## Sources covering this story - https://www.foxnews.com/tech/hackers-hide-dangerous-fake-ai-downloads-behind-google-ads — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._