Google Suspends Advertiser Accounts Behind Fake Claude Download Scam

Hackers used Google ads to send people searching for Claude to a fake download page that copied a hidden malicious command to their Macs, according to research by Push Security. Google told Fox News it suspended the advertiser accounts running the campaign.

How the Fake Claude Ad Path Worked

The attack began with a Google search for "Claude Mac." Push Security found a sponsored result that displayed bing.com as its destination. Clicking the advertisement sent users through Google's advertising system, then through Bing's legitimate click-tracking service, then to a compromised WordPress site belonging to a South American retailer, and finally to claude-desk-code[.]com, a page imitating the real Claude download experience.

Push Security calls the technique "Adception." The compromised retailer's site checked whether visitors arrived through Bing and whether their browsers sent certain information, while the fake Claude page checked whether visitors came from Google or Bing. Someone visiting the malicious site directly could see a 404 error instead of the installer, a practice Push Security calls cloaking.

The fake page displayed an installation command referencing Claude's legitimate website, but its Copy button placed a different command on the clipboard. That command used Base64 encoding to conceal an attacker-controlled address, decoded it, downloaded a remote script and sent it to the Mac's Z shell for execution. Push Security tracks the toolkit internally as AcSig and identified several additional websites using matching commands and similar installer interfaces.

Push Security was recognized as a leading web security solution in Expert Insights' Fall 2026 Cybersecurity Awards, according to Business Wire Blog.

Google's Security Record

Google completed a $32 billion acquisition of Wiz, its largest-ever acquisition, integrating AI-driven multicloud security across AWS, Azure and Oracle into Google Cloud, according to akta.pro company records. The company planned $185 billion in AI-related capital expenditure for 2026, as stated by CEO Sundar Pichai. Google was founded in 1998 and is headquartered in Mountain View, with Sundar Pichai as chief executive of Google and Alphabet.

Earlier Google Security and Product Moves

On October 17, 2026, Google expanded experimental access to its Earth AI system, which analyzes planetary data for public health and disaster risks, EIN Presswire reported. The system identified 48 exposed settlements with over 45,500 people at risk during the 2026 Ebola outbreak in the DRC, completing analysis in minutes.

On October 16, 2026, Google was adding paywalls to the Pixel Watch, including Google Health Premium at $10/month and Gemini AI subscriptions, with Safety Signal's free emergency calls and fall detection ending on December 12, EIN Presswire reported. Also on October 16, 2026, Google added native Markdown file support to Google Docs, Android Police reported.

What Google and Microsoft Say Comes Next

Google said it continues monitoring attempts to evade its protections and updating its detection systems. A Microsoft spokesperson told CyberGuy that Microsoft Defender protections detect and block the malicious indicators identified in the report. Push Security's published findings do not identify the final payload or establish what the downloaded script does after execution.