A malvertising campaign uses Google ads and legitimate Bing redirects to lead macOS users searching for 'Claude Mac' to fake Claude installers. The goal is for the victim to execute by themselves, in Terminal, a malicious ClickFix-type command that downloads a malicious file.
With this technique, the link apparently seems trustworthy and helps evade certain advertising controls. After the click, various redirects occur that end on a fake page mimicking the Claude download. The fraudulent page shows an installation instruction that appears legitimate for Claude on macOS. However, when pressing the copy button, silently replaces the clipboard content with a different command to be pasted into the Terminal, which downloads a file from infrastructure controlled by the attackers and executes it zsh.
To avoid downloading this type of file, it is recommended to download Claude only from Anthropic's official channels, without trusting sponsored ads to access installers, check the actual command before pasting or executing it in the Terminal and be wary of redirection chains between unrelated domains, especially if a Google ad opens a Bing link before reaching a download.
Fountain: Bleeping Computer