Cybercriminals are exploiting legitimate Bing search result redirects as click-through URLs in Google Search ads to trick users into downloading fake Claude AI installers that deliver malware. This campaign, observed in October 2026, uses deceptive advertising to bypass security filters and target individuals seeking AI tools. The attackers manipulate ad platforms to serve malicious links that appear trustworthy due to their association with Bing’s redirect infrastructure.
The technique, labeled Adceptionby researchers at Push Security, involves hijacking Bing’s legitimate redirect mechanisms—normally used to track ad clicks—to embed them as destination URLs in Google Ads. When users click the ad, they are routed through Bing’s redirect service before landing on a fraudulent site offering a counterfeit Claude installer. Once executed, the installer deploys ClickFix malware, which can steal credentials, hijack sessions, and establish persistent access on infected systems. Researchers noted that the fake installers closely mimic the official Claude interface, increasing the likelihood of user deception.
By using Bing’s official redirect domains, attackers leverage the reputation of trusted Microsoft services to avoid detection by ad scanners and endpoint security tools. These redirects are not inherently malicious, making them ideal for abuse in multi-layered fraud schemes. Push Security analysts explained that the attackers likely compromised or spoofed Bing ad accounts or exploited misconfigurations in ad serving pipelines to inject these redirect links. The campaign demonstrates a growing trend of threat actors abusing legitimate web infrastructure to enhance the credibility of social engineering attacks.
The use of cross-platform ad abuse—combining Google Ads as the delivery vector and Bing redirects as the obfuscation layer—creates a complex attack chain that is difficult to trace and block. Unlike traditional malvertising that relies on newly registered domains, this method reuses legitimate, high-reputation URLs, reducing the chances of immediate blacklisting. Victims are often professionals or developers searching for AI productivity tools, making them high-value targets for credential theft and data exfiltration. Security teams warn that detecting such abuse requires monitoring for unusual redirect patterns rather than solely blocking known malicious domains.
How do attackers use Bing redirects in Google Ads? They embed Bing’s legitimate click-tracking redirect URLs as the destination in Google Search ads, routing users through trusted Microsoft infrastructure before reaching malicious sites.
What is ClickFix malware and what does it do? ClickFix is a type of infostealer malware that captures login credentials, session tokens, and browser data, often used to compromise online accounts and corporate systems.
Why is this hard to detect with standard security tools? Because the redirect URLs belong to legitimate services like Bing, they are not flagged as malicious by reputation-based filters, allowing the attack chain to bypass initial security checks.