Ali Ikhwan
In an era where digital trust is the primary currency of the internet, a new and alarming malvertising campaign has emerged, demonstrating the creative lengths to which threat actors will go to bypass modern security protocols. Security researchers at Push Security have uncovered a highly sophisticated campaign—dubbed "Adception"—that weaponizes legitimate search engine infrastructure to deliver malicious payloads to unsuspecting macOS users.
By exploiting the click-tracking mechanisms of major search platforms, specifically Bing, attackers are successfully injecting malicious intent into what appears to be a verified, trusted advertisement. This campaign highlights a critical vulnerability in the ecosystem of digital advertising, where the very tools designed to facilitate traffic are being repurposed to serve as cloaks for cyberattacks.
The Mechanics of Adception: Abusing Trusted Domains
At the heart of the Adception campaign is a clever abuse of trust. Typically, malicious advertisements lead users to domains that are either registered by the attacker or parked on compromised servers. Security filters and automated scanners are generally adept at flagging these domains based on reputation scores, age, and content analysis.
The Adception campaign subverts this process by leveraging the legitimate bing.com domain. When a user clicks on a malicious Google Search ad—specifically targeting users searching for "Claude for Mac"—they are not immediately directed to a shady URL. Instead, the click passes through Google’s ad redirect and then enters Bing’s legitimate bing.com/ck/a click-tracking endpoint.
Because the final destination displayed in the ad’s "destination URL" field is a reputable, high-authority domain like Bing, the advertisement bypasses initial security checks implemented by Google. The user’s browser is then forwarded from Bing to a legitimate, yet compromised, WordPress website. This site acts as a secondary layer of obfuscation, ensuring that only users who have arrived via the intended search engine referral are permitted to proceed.
A Chronology of the Attack Path
To understand the scale and precision of this campaign, one must trace the step-by-step journey of a victim from a standard search query to potential system compromise.
1. The Lure
The attack begins with a user searching for the Claude desktop application for macOS. The attackers have optimized their Google Search ad to appear at the top of the results, mirroring legitimate branding. The ad appears professional and trustworthy, leading the user to believe they are clicking on an official download link.
2. The Redirect Chain
Upon clicking the ad, the user is shuttled through a rapid sequence of redirects. First, Google tracks the click for billing and analytical purposes. Then, the traffic is handed off to Bing’s bing.com/ck/a tracking system. This step is pivotal; it provides the "stamp of approval" that makes the ad seem legitimate to both the user and automated security crawlers.
3. The Compromised Gateway
The final destination of the Bing redirect is not the fake site itself, but a compromised WordPress site—often belonging to small, legitimate entities like South American retailers. These sites serve as the "gatekeepers." They employ sophisticated server-side checks to verify that the visitor is not a security researcher or a sandbox environment. If the request does not include the correct referrer (Bing or Google), the visitor is served a 404 error page, effectively hiding the malicious infrastructure from public view.
4. The Payload Delivery
Once verified, the user is forwarded to a site such as claude-desk-code[.]com. This site is designed to look identical to a legitimate software distribution page. It instructs the user to copy a terminal command to "install" the software. This is where the "ClickFix" social engineering tactic comes into play.
The ClickFix Deception: Clipboard Manipulation
The most insidious part of the Adception campaign is the "ClickFix" mechanism. On the fake download page, the user is presented with an installation command that looks exactly like the official Anthropic documentation: curl -fsSL https://claude.ai/install.sh | bash.
However, the "Copy" button on the webpage is rigged. When the user clicks it, they are not copying the legitimate command displayed on the screen. Instead, a hidden JavaScript function swaps the clipboard content for a malicious, obfuscated command.
The malicious command is designed to perform a series of silent, background operations:
- It prints a fake message to the terminal, mimicking the legitimate installation process.
- It decodes a Base64 string that points to a secondary, attacker-controlled domain (
lake-90[.]com). - It uses
curlto silently fetch a.datfile, which is then piped directly into the macOS shell (zsh) for immediate execution.
Because the user sees the "correct" command in their terminal, they are lulled into a false sense of security, believing the installation is proceeding normally while their system is being silently compromised.
Implications for Digital Security
The Adception campaign represents a significant shift in the tactics of cybercriminals. By moving away from "dirty" domains and toward the abuse of "clean" infrastructure, attackers have created a problem that is difficult for traditional security software to solve.
The Erosion of Domain Reputation
Security systems rely heavily on domain reputation. If a domain is owned by a major tech company like Microsoft (Bing), it is rarely blocked. This campaign proves that domain reputation is no longer a foolproof metric for safety. Security vendors must now move toward analyzing the behavioral flow of redirects rather than just the reputation of the destination URL.
The Rise of ClickFix
ClickFix attacks represent a "human-in-the-loop" vulnerability. Even the most hardened system can be compromised if the user is tricked into granting high-level permissions or running commands in the terminal. The psychological manipulation inherent in these attacks—using familiar, expected command-line syntax—is highly effective.
Challenges for Automated Scanners
Because the malicious infrastructure is guarded by referrer checks and cloaking, automated security scanners often see nothing but a 404 page. This "security through obscurity" allows attackers to keep their malicious sites active for longer periods, as they remain invisible to the very tools designed to hunt them down.
Addressing the Threat: What Can Be Done?
Defending against an attack as sophisticated as Adception requires a multi-layered approach involving both individual users and security professionals.
For Users
- Verify Sources: Never copy and paste commands from a website into your terminal unless you are 100% certain of the source. Even then, paste the command into a text editor first to inspect its contents.
- Official Channels Only: Always navigate directly to a company’s official website by typing the URL into your browser rather than clicking on sponsored search results.
- Monitor System Behavior: Be wary of any terminal window that requests elevated permissions or begins downloading files silently.
For Security Professionals
- Redirect Monitoring: Security tools should implement deeper inspection of redirect chains. If a redirect originates from a trusted search engine but terminates at a domain with no clear relation to the original search, it should be flagged for investigation.
- Clipboard Integrity: Researchers have suggested that browsers could potentially implement warnings when a webpage attempts to modify the clipboard content significantly, especially when that content contains shell commands.
- Endpoint Detection and Response (EDR): EDR solutions must be tuned to detect the execution of suspicious shell commands originating from common browsers. The pattern of
curlfollowed by a pipe intozshorbashis a classic indicator of compromise that should trigger an immediate alert.
Conclusion: The New Frontier of Malvertising
The Adception campaign is a stark reminder that the digital landscape is constantly evolving. As defenders build higher walls, attackers are finding ways to walk through the front door by disguising themselves as trusted entities.
The use of Bing’s click-tracking infrastructure as a vehicle for malware is a masterclass in exploiting the trust architecture of the modern web. While security researchers at Push Security have successfully identified and categorized this campaign, the underlying vulnerabilities—the ease with which search ads can be gamed and the inherent dangers of terminal-based installations—remain.
As we move toward a future where AI and automated tools play a larger role in both attack and defense, the battle will not be won by technology alone. It will be won by a combination of smarter detection tools and a more vigilant user base. For now, users should treat every sponsored search result with a healthy dose of skepticism, remembering that in the world of malvertising, the most trusted paths are often the most dangerous.
Basiran
