{"url":"https://newsforagent.com/news/2026-10-17/google-suspends-ads-fake-claude-downloads","markdown_url":"https://newsforagent.com/news/2026-10-17/google-suspends-ads-fake-claude-downloads.md","title":"Google Suspends Ad Accounts Over Fake Claude Downloads","headline":"Google Suspends Advertiser Accounts Behind Fake Claude Download Scam","description":"Google suspended advertiser accounts after Push Security found fake Claude downloads hidden behind sponsored search ads and Bing redirects.","section":"Incidents","published_at":"2026-10-17T14:46:31+00:00","modified_at":"2026-10-17T14:46:31+00:00","author":"News Desk","key_takeaways":["Push Security found a sponsored Google ad for \"Claude Mac\" that routed users through Bing's click-tracking service to a fake Claude download page.","The fake page's Copy button placed a Base64-encoded command on the clipboard that downloaded and executed a remote script on Mac.","Google said it suspended the advertiser accounts running the campaign, and Microsoft said Defender detects the malicious indicators."],"companies":[{"name":"Google","is_primary":true,"profile_url":"https://akta.pro/company-profiles/00000r9/google","website":"https://www.google.com"},{"name":"Push Security","is_primary":false,"profile_url":"https://akta.pro/company-profiles/00003ux/push-security","website":"https://pushsecurity.com"},{"name":"Microsoft","is_primary":false,"profile_url":"https://akta.pro/company-profiles/000026e/microsoft","website":"https://www.microsoft.com"}],"source":{"publisher":"Fox News","title":"Hackers hide dangerous fake AI downloads behind Google ads","url":"https://www.foxnews.com/tech/hackers-hide-dangerous-fake-ai-downloads-behind-google-ads"},"other_sources":[],"tags":["Incidents","Google","Push Security","Microsoft"],"body_markdown":"Hackers used [Google](https://akta.pro/company-profiles/00000r9/google) ads to send people searching for Claude to a fake download page that copied a hidden malicious command to their Macs, according to research by [Push Security](https://akta.pro/company-profiles/00003ux/push-security). Google told [Fox News](https://www.foxnews.com/tech/hackers-hide-dangerous-fake-ai-downloads-behind-google-ads) it suspended the advertiser accounts running the campaign.\n\n## How the Fake Claude Ad Path Worked\n\nThe attack began with a Google search for \"Claude Mac.\" Push Security found a sponsored result that displayed bing.com as its destination. Clicking the advertisement sent users through Google's advertising system, then through Bing's legitimate click-tracking service, then to a compromised WordPress site belonging to a South American retailer, and finally to claude-desk-code[.]com, a page imitating the real Claude download experience.\n\nPush Security calls the technique \"Adception.\" The compromised retailer's site checked whether visitors arrived through Bing and whether their browsers sent certain information, while the fake Claude page checked whether visitors came from Google or Bing. Someone visiting the malicious site directly could see a 404 error instead of the installer, a practice Push Security calls cloaking.\n\nThe fake page displayed an installation command referencing Claude's legitimate website, but its Copy button placed a different command on the clipboard. That command used Base64 encoding to conceal an attacker-controlled address, decoded it, downloaded a remote script and sent it to the Mac's Z shell for execution. Push Security tracks the toolkit internally as AcSig and identified several additional websites using matching commands and similar installer interfaces.\n\nPush Security was recognized as a leading web security solution in Expert Insights' Fall 2026 Cybersecurity Awards, according to Business Wire Blog.\n\n## Google's Security Record\n\nGoogle completed a $32 billion acquisition of Wiz, its largest-ever acquisition, integrating AI-driven multicloud security across AWS, Azure and Oracle into Google Cloud, according to [akta.pro company records](https://akta.pro/company-data). The company planned $185 billion in AI-related capital expenditure for 2026, as stated by CEO Sundar Pichai. Google was founded in 1998 and is headquartered in Mountain View, with Sundar Pichai as chief executive of Google and Alphabet.\n\n## Earlier Google Security and Product Moves\n\nOn October 17, 2026, Google expanded experimental access to its Earth AI system, which analyzes planetary data for public health and disaster risks, EIN Presswire reported. The system identified 48 exposed settlements with over 45,500 people at risk during the 2026 Ebola outbreak in the DRC, completing analysis in minutes.\n\nOn October 16, 2026, Google was adding paywalls to the Pixel Watch, including Google Health Premium at $10/month and Gemini AI subscriptions, with Safety Signal's free emergency calls and fall detection ending on December 12, EIN Presswire reported. Also on October 16, 2026, Google added native Markdown file support to Google Docs, Android Police reported.\n\n## What Google and Microsoft Say Comes Next\n\nGoogle said it continues monitoring attempts to evade its protections and updating its detection systems. A [Microsoft](https://akta.pro/company-profiles/000026e/microsoft) spokesperson told CyberGuy that Microsoft Defender protections detect and block the malicious indicators identified in the report. Push Security's published findings do not identify the final payload or establish what the downloaded script does after execution.\n","publisher":{"name":"News for Agent","url":"https://newsforagent.com"}}