{"id":238127,"date":"2026-10-12T07:00:23","date_gmt":"2026-10-12T14:00:23","guid":{"rendered":"https:\/\/www.mcafee.com\/blogs\/?p=238127"},"modified":"2026-10-14T11:24:11","modified_gmt":"2026-10-14T18:24:11","slug":"adception-deceptive-search-ads","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/security-news\/adception-deceptive-search-ads\/","title":{"rendered":"New Adception Campaign Weaponizes Search Ads: How to Stay Safe From Malvertising"},"content":{"rendered":"

A new cyberattack is weaponizing everyday search results to trick users into running malicious code on their devices. The campaign, dubbed “Adception,” was uncovered by Push Security<\/a>. By buying paid search ads on Google and routing traffic through trusted web services, attackers are placing deceptive links directly in front of people searching for popular software. Then, they use a social engineering framework known as \u201cClickFix\u201d<\/a> to trick people into running malicious scripts on their devices.<\/p>\n

How the Adception Campaign Works<\/strong><\/h2>\n

Search ads appear at the very top of search engine results, making them easy to click and easy to trust. Malvertising (short for malicious advertising)<\/a> occurs when cybercriminals buy or hijack legitimate ad placements to spread malware or direct users to fraudulent websites. In this campaign, attackers purchase legitimate ad slots but route clicking visitors through a hidden chain of web redirects before loading a fraudulent website. This detour conceals the final destination from automated ad-review crawlers, allowing malicious ads to bypass platform security filters and reach active searchers.<\/p>\n

According to Push Security\u2019s research, the threat actors specifically targeted Mac users searching for Anthropic’s Claude AI assistant. To evade automated detection, the attack chain bounces traffic through legitimate Bing click-tracking redirects and a compromised website. Once a visitor lands on the fake software portal, the attackers deploy an evasion technique known as “ClickFix,” using deceptive troubleshooting prompts to trick macOS users into executing base64-encoded malware directly inside the Z shell (zsh).<\/p>\n

The campaign executes across five distinct stages:<\/p>\n

    \n
  1. Sponsored Search Ad Placement:<\/strong> Attackers purchase top-ranked Google search ads that bid on keywords for Anthropic\u2019s Claude desktop app.<\/li>\n
  2. Cross-Engine Redirection (Google to Bing):<\/strong> Clicking the Google ad routes the visitor through legitimate Bing click-tracking infrastructure. The attackers use this cross-engine detour because automated Google ad-review crawlers do not expect ad traffic to route through a competitor’s tracking domain, effectively blinding them to the ultimate destination.<\/li>\n
  3. Compromised Intermediary Site:<\/strong> The traffic forwards to a compromised WordPress site owned by a South American retailer, which runs two layers of cloaking to weed out automated scanners and non-Mac operating systems.<\/li>\n
  4. Deceptive Landing Page:<\/strong> Qualifying visitors land on a counterfeit webpage that closely mimics Anthropic\u2019s official website and branding.<\/li>\n
  5. ClickFix Terminal Execution:<\/strong> The landing page displays a fake installation error and activates the “AcSig” ClickFix toolkit, which hijacks the user’s clipboard and instructs them to paste code into the macOS Terminal to “fix” the download.<\/li>\n<\/ol>\n

    Warning Signs of Deceptive Search Ads<\/strong><\/h2>\n