Affected Systems
Users searching for Claude AI via Google Ads or Bing search. Campaign abuses legitimate redirect mechanisms from Bing and Google Ads infrastructure to distribute malicious installers impersonating Anthropic's Claude AI assistant.
Exploitation Status
Active campaign in the wild. Attackers are actively using Google Ads and Bing redirect mechanisms to distribute ClickFix malware through fake Claude installers.
Business Impact
Users searching for legitimate AI tools may be redirected to malicious sites hosting fake installers. ClickFix attacks typically involve social engineering to trick users into executing PowerShell commands or malicious scripts, leading to credential theft, malware installation, or initial access for further compromise. Legitimate redirect infrastructure abuse makes detection and blocking more difficult as URLs appear to originate from trusted domains (Google, Bing).
Urgency
🟠Within 24 hours
Recommended Actions
- Block or heavily scrutinize ads for Claude AI and similar AI tools; educate users to download only from official anthropic.com domain
- Implement DNS filtering or web proxy rules to block known ClickFix campaign indicators and suspicious PowerShell execution patterns
- Monitor endpoint logs for unusual PowerShell execution, especially commands launched from browser processes or user-initiated scripts
- Deploy email and web gateway alerts for ClickFix social engineering patterns (e.g., instructions to run commands, fake error messages)
- Review Google Ads and Bing search traffic logs for anomalous redirect chains or suspicious ad click patterns targeting AI tool searches