When a Google Ad Becomes a Trap
You’re sitting at your computer, looking for a piece of software.
You open Google, type in what you’re looking for, and there it is. Right near the top of the search results.
A nice, professional-looking link. A familiar website address. Maybe even a little “Sponsored” label.
You click it.
Congratulations. You may have just walked into somebody else’s trap.
And no, I’m not talking about one of those ridiculous emails claiming a Nigerian prince needs your banking information.
I’m talking about a legitimate Google advertisement that sends you through Microsoft’s Bing search engine, bounces you off a compromised website, and deposits you on a convincing fake software download page.
All so someone can trick you into running malicious code on your own computer.
Welcome to the wonderfully screwed-up world of modern cybercrime.
What Happened?
On October 9, 2026, researchers at Push Security published details of a particularly clever cyberattack they’ve nicknamed Adception.
The attack targeted people searching Google for “claude mac,” presumably looking to install Anthropic’s Claude AI software on their Apple computers.
The attackers purchased a Google search advertisement.
Nothing particularly unusual there. Criminals have been buying advertising space to distribute malicious links for years. The practice is called malvertising, which is cybersecurity’s way of combining “malicious” and “advertising” into one suitably ugly word.
But this campaign had a twist.
Rather than sending someone directly to a suspicious-looking website, the advertisement displayed a legitimate Microsoft Bing address.
Yes, Bing.
Google showed an advertisement pointing to Microsoft’s search engine.
And that was only the beginning.
According to Push Security’s investigation, clicking the advertisement started a chain of redirects:
- The visitor clicked the sponsored Google result.
- Google forwarded the visitor to a legitimate Bing search-result redirect.
- Bing forwarded the visitor to a real but compromised retailer’s website.
- That website redirected the visitor to a fraudulent Claude download page.
By the time the visitor arrived, they’d passed through multiple legitimate services.
The attacker was effectively using trusted websites as stepping stones to hide the final destination.
It’s the digital equivalent of getting directions to a reputable hotel, only to discover that somebody redirected the road into a back alley where a guy named Chainsaw is waiting to carry your luggage.
Source: Push Security, October 9, 2026.
The Really Clever Part? The Fake Installer
Getting someone onto a malicious website is only half the job.
The attackers still needed their victim to do something.
The fake Claude download page looked convincing. It offered a macOS download and provided instructions for installing the software using Apple’s Terminal application.
For those unfamiliar with Terminal, it’s a utility that allows you to type commands directly into your Mac.
Extremely useful.
Also extremely capable of making your day miserable when you run something you don’t understand.
Here’s where the attackers got creative.
The fake installation page actually displayed a legitimate Claude installation command.
But when the visitor clicked the convenient little Copy button, the website secretly placed a completely different command onto the computer’s clipboard.
That substituted command was designed to download and execute a script from an attacker-controlled server.
To make matters worse, it also printed a reassuring message referencing the legitimate Claude website.
So the victim could see the correct command on the webpage, click Copy, paste something different into Terminal, and still see an apparently legitimate download message.
That’s not a typo.
The website showed one thing and copied another.
And unless the victim carefully examined the pasted command before executing it, the substitution might go unnoticed.
The researchers confirmed that the command attempted to retrieve and execute attacker-controlled content. At the time of publication, the final payload had not been identified.
That distinction matters. We know what the command was designed to do, but we shouldn’t claim researchers confirmed a specific malware infection when they hadn’t.
Source: Push Security and BleepingComputer, October 9, 2026.
But Google Wouldn’t Allow a Malicious Ad, Right?
I’d love to tell you that every advertisement appearing in Google’s search results has been thoroughly investigated, authenticated, and personally blessed by a committee of cybersecurity professionals.
Unfortunately, that isn’t how advertising works.
Advertising platforms have security checks, and they work to detect malicious campaigns.
But criminals constantly look for ways around those checks.
In this case, the advertisement’s visible destination was Bing, a legitimate and recognizable website.
The actual malicious page was several redirects away.
The attackers also configured parts of their operation to check how visitors arrived. Someone coming through the intended search-engine path could receive the malicious content, while someone visiting the suspicious URL directly might see an error page instead.
That made the operation harder for automated security systems and investigators to examine.
The important lesson?
A sponsored search result is an advertisement, not a security certification.
Someone paid to put that result in front of you.
That doesn’t mean the software is legitimate.
It doesn’t mean the advertiser is trustworthy.
And it certainly doesn’t mean you should execute whatever command the destination website tells you to run.
This Isn’t Just a Mac Problem
Today’s reported campaign specifically targeted macOS users searching for Claude.
But don’t make the mistake of thinking this is exclusively an Apple problem.
The broader technique works because it exploits human behavior.
We search for software.
We trust familiar names.
We click convenient results.
We follow installation instructions.
And increasingly, we’re becoming comfortable copying commands from websites into powerful system utilities.
Windows users can encounter similar tricks involving PowerShell or the Run dialog.
Linux users may be directed to shell commands.
Mac users may be instructed to paste commands into Terminal.
The operating system changes.
The trick remains pretty much the same.
Convince someone that a dangerous action is a normal part of installing software, fixing a problem, or completing a security check.
Cybersecurity professionals call this type of manipulation social engineering.
I call it getting somebody else to do your dirty work.
Five Ways to Avoid Getting Hooked
Fortunately, you don’t need a degree in cybersecurity to reduce your chances of falling for this sort of attack.
You just need to develop a few habits.
1. Go Directly to the Source
If you’re looking for software, visit the manufacturer’s official website.
Don’t automatically select the first Google result.
For example, if you’re looking for Claude, start with Anthropic’s official website rather than trusting an advertisement claiming to offer an installer.
Bookmark trusted vendor websites if you use them frequently.
And when downloading software, make sure you’re actually on the vendor’s domain, not an imitation with extra words, strange spelling, or an unfamiliar extension.
2. Treat Sponsored Results With Caution
I’m not suggesting every sponsored result is malicious.
Far from it.
But an advertisement is not inherently more trustworthy than an ordinary search result.
When possible, skip the sponsored links and navigate directly to the website you intended to visit.
If you do click an advertisement, pay attention to where you actually land.
Remember, today’s campaign demonstrated that even a legitimate domain appearing in an advertisement doesn’t guarantee a safe final destination.
3. Don’t Blindly Paste Commands
This is probably the most important lesson from today’s story.
Never execute a command simply because a website tells you to copy and paste it.
Especially if the instructions involve Terminal, PowerShell, or another command-line utility.
If you don’t understand what a command does, stop and investigate.
Commands that download a script from the Internet and immediately execute it deserve particular scrutiny.
Even when the installation instructions appear professional.
Even when the product is popular.
Even when the website looks legitimate.
And especially when a website tells you to hurry.
If you’re using a website’s Copy button, examine what actually appears in the command line before running it. Copying text and executing it are two different decisions.
4. Keep Your Security Tools Updated
Modern operating systems include security mechanisms designed to identify and block malicious software.
Keep them enabled.
Install security updates.
Use reputable endpoint protection where appropriate.
And don’t disable built-in security features just because a download page claims they’re interfering with installation.
Security software isn’t perfect. This campaign itself demonstrates how creative attackers can become.
But removing your existing protections because some random webpage instructed you to do so is a particularly bad bargain.
5. Pay Attention to Unexpected Behavior
If a software installation suddenly asks you to perform unfamiliar steps, think about why.
Does installing this program normally require Terminal?
Why does a download website want you to run a command instead of using a normal installer?
Why did the browser send you through several unrelated websites?
Why is the installation process asking you to change security settings?
Any one of these might have an innocent explanation.
Several together should make you suspicious.
And if something feels wrong, there’s absolutely nothing embarrassing about stopping.
The Internet will still be there in five minutes.
Probably.
What If You Already Ran Something Suspicious?
First, don’t panic.
But don’t ignore it either.
If you’ve executed an unfamiliar command from a suspicious website, treat the computer as potentially compromised until you have reason to believe otherwise.
Disconnect it from the network if you suspect malicious software executed, especially if the device contains sensitive information.
If it’s a work computer, contact your organization’s IT or security team immediately. Don’t try to quietly clean it up and hope nobody notices.
On a personal device, use a trusted security tool, obtain qualified assistance if needed, and avoid entering additional sensitive information until the system has been assessed.
If you believe credentials or active sessions may have been exposed, change affected passwords using a different, trusted device, revoke suspicious sessions, and review account activity.
Depending on what executed, reinstalling the operating system from trusted media may be the safest recovery option.
Simply closing the browser doesn’t necessarily undo a command that has already run.
And remember, the researchers investigating this specific attack had not confirmed the final payload when they published their findings. The actual consequences for someone who executed it would depend on what the attacker-controlled script delivered.
The Bigger Problem Is Trust
What makes this particular attack interesting isn’t that somebody created a fake download page.
Criminals have been doing that for ages.
It isn’t even that somebody bought a malicious Google advertisement.
That’s old news too.
The interesting part is how the attackers stitched together several legitimate services to make a malicious journey appear respectable.
Google served the advertisement.
Bing provided the redirect.
A compromised legitimate website provided another redirect.
And a fake download page supplied instructions that appeared trustworthy while copying something entirely different.
Each piece helped obscure what was actually happening.
That’s the uncomfortable reality of modern cybersecurity.
Sometimes the danger isn’t an obviously suspicious website with flashing warnings and terrible spelling.
Sometimes it’s a polished webpage reached through familiar services, offering a helpful button and instructions that seem perfectly reasonable.
The Bottom Line
Google is a search engine.
Not your personal cybersecurity bodyguard.
Microsoft’s Bing is a search engine too.
Not a guarantee that every destination reached through its links is safe.
And a professional-looking installation page is still just a webpage until you’ve verified that it’s legitimate.
The next time you’re downloading software, slow down long enough to make sure you’re getting it from the actual source.
Check the address.
Question unfamiliar instructions.
And for the love of all things digital, don’t blindly execute commands you copied from some webpage.
Because sometimes the most dangerous thing you can do to your computer isn’t downloading a suspicious file.
It’s politely following instructions.
Fair winds, strong passwords, and keep your digital powder dry.
Griz
Griz Lite: Cybersecurity without the corporate word salad.
Sources and Further Reading
- Push Security, October 9, 2026: Adception: Malvertising Another Search Engine’s Search Results to Redirect to a Malicious Page, by Luke Jennings. Original investigation documenting the Google Ads, Bing redirect, compromised website, and clipboard-substitution technique.
- BleepingComputer, October 9, 2026: Hackers Abuse Google Ads, Bing Redirects to Push Claude ClickFix Attacks, by Lawrence Abrams. Independent reporting on the research and the malicious installation workflow.