People who install command-line tools are used to copying one line from the vendor and pasting it into a terminal. The line is supposed to come from the company that made the tool. Push Security described a sponsored Google result, for a search such as "claude mac", that used that habit. The ad was allowed to display bing.com as the destination. Bing is a real address. The install command on the far side was not Anthropic's, the company that makes Claude.
The sponsored result in the picture does not even bother to hide the later page. It offers Claude Code and points at claude-desk-code.com. The version Push Security followed was sneakier, because the address you could see was Bing.
How it works
- A sponsored result for a search such as "claude mac" is allowed to display bing.com as its destination. A real domain in the ad is the reason it does not look like a strange download site.
- Bing's click tracking forwards you to a compromised retail site, which forwards you to a fake download page. Anyone who did not arrive through the ad is shown a harmless page, so a scanner that opens the address directly may never see the lure.
- The page shows a real-looking install line. The command copied to the clipboard is a different one. You can read one sentence and paste another.
- You paste it into a terminal because that is how these tools are installed. The paste is the point of the ad. ClickFix is the name researchers use for this family: a page that fixes nothing, and asks you to run a command to "fix" it.
Signs and red flags
A sponsored result for software, especially one whose visible domain is a search engine rather than the maker. A download page you reached in more than one hop. A terminal command you are asked to paste, when you could have opened claude.ai yourself. A page that looks blank or broken unless you arrived from the ad. Anyone telling you the install "has to" be done from a copied line in a chat or a search result. Anthropic's own site is a place you can type. An ad is not a shortcut to it.
Cases and figures
Push Security's write-up, reported by BleepingComputer, is a technique report rather than a victim count for this ad. There is no public figure for how many people pasted this particular command. What the same researchers did count is the wider habit. Through the second quarter of 2026 ClickFix made up about 52 per cent of their detections, and 67 per cent in August. Four in five ClickFix pages they intercepted in 2026 were reached from search. ANY.RUN, cited in that note, linked 1,258 public sandbox analyses to fake AI-tool campaigns between 15 April and 5 October 2026, and said 81 per cent impersonated Claude or ChatGPT and Codex. Those percentages are one company's detections, not a census of the internet. Each ring below is its own total. They do not add up to one pie of "all ads".
Search is the doorway because that is where a person who wants the real tool goes looking. The ad sits above the real result and borrows a domain the person already trusts.
What to do and where to report
Go to the vendor's site by typing it, or open the app you already trust. Do not paste a terminal command from an ad, a shared chat or a download page you found in search. If you already did, disconnect that Mac from sensitive accounts, change the passwords from another device, and treat the machine as untrusted until someone competent looks at it. Report the ad in the search engine, and if money or account access went with it, file at ic3.gov in the United States or Action Fraud in the United Kingdom.
If you were hit, start at Get help. A stranger who offers to "clean the Mac" for a fee, after you mention the paste, is the same trade: Fake recovery.
This is general information, not legal or financial advice. The rules and the figures change. If money has already left, contact the bank and the authorities through the help pages.