Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Attackers are abusing Bing search-result redirect URLs as click destinations in Google search advertisements. When users click these ads, they are redirected through Bing's legitimate infrastructure to fake Claude software installers. These installers then deliver ClickFix attacks, which likely involve malware installation or unwanted software delivery. The technique exploits the trust users place in search ads and legitimate redirect URLs to bypass suspicion and security controls.

Users who click on these malicious ads may be redirected to fake software installers that deliver ClickFix attacks, potentially leading to malware infection or unwanted software installation on their devices. This can compromise user security and privacy. The abuse of legitimate Bing redirects in Google Ads may also undermine trust in these platforms' advertising ecosystems.

No specific vendor advisory or patch information is provided. Users and organizations should exercise caution when clicking on search ads, especially those redirecting through multiple domains. Security solutions should monitor for and block known ClickFix malware and fake Claude installers. Vendors managing Bing and Google Ads platforms should investigate and mitigate abuse of their redirect mechanisms. Patch status is not yet confirmed — check vendor advisories for current remediation guidance.