Hackers Abuse Google Ads and Bing Redirects to Launch Claude ClickFix Attacks

Attack Overview

A security intelligence report from the Hacker News community reveals that attackers are leveraging Google Ads placements and Bing search engine redirect mechanisms to push ClickFix attacks targeting users of Claude, Anthropic's AI assistant. This technique exploits the implicit trust of mainstream search platforms to funnel users toward malicious pages, where deception and exploitation take place.

It's worth noting that the original source material is limited, providing only the basic framework and key terminology of the attack. This article builds on that foundation using publicly available knowledge about the ClickFix attack pattern to offer contextual analysis, helping readers understand how it works and how to defend against it.

What Is a ClickFix Attack

ClickFix is an increasingly prevalent social engineering attack technique. The typical playbook involves luring users to a seemingly legitimate page — such as a fake software download site, CAPTCHA verification prompt, or system error notice — which then displays a "fix guide" instructing the user to manually copy a command and paste it into the system's Run dialog or terminal for execution.

Once the user complies, the command typically downloads and executes a malicious payload from a remote server, bypassing the browser's built-in download security checks. What makes ClickFix particularly dangerous is that it hands the attack's "final step" to the user themselves, exploiting the human tendency to "just follow the instructions to fix the problem" — effectively circumventing traditional automated defenses.

ClickFix was first systematically documented by security researchers in early 2024 and has since spread rapidly worldwide. Common trigger scenarios include: fake CAPTCHA human verification prompts (asking users to "prove you're not a robot"), fake browser font-missing alerts, and spoofed Microsoft or Google system error pop-ups. Attackers typically pre-fill the malicious command on the page, requiring only a keyboard shortcut (such as Win+R to open the Run dialog, or Ctrl+V to paste into PowerShell) to trigger execution.

On the technical side, the executed commands are typically a single obfuscated PowerShell or mshta instruction that fetches the next-stage malicious payload from a remote CDN. Because the entire download-and-execute process occurs within a system process rather than the browser sandbox, protection layers such as SmartScreen and browser security warnings are completely bypassed. Researchers have observed this technique being used to distribute infostealers, remote access trojans (RATs), and ransomware pre-loaders.

Search Ads and Redirects as Attack Entry Points

The core of this incident lies in attackers' abuse of Google Ads and Bing redirects. By purchasing keyword ads related to Claude and AI tools, attackers position malicious links prominently in search results. Since ad placements appear at the top of the search page and carry an implicit platform trust, ordinary users find it extremely difficult to distinguish legitimate from malicious results.

Abusing Bing's redirect links is another common disguise tactic. Attackers conceal the final malicious destination behind a redirect URL from a legitimate search engine, making the initially visible URL appear to be a trusted domain. Only after clicking does the user get forwarded to the actual phishing or drive-by page. This "borrowed shell" redirect technique dramatically increases deceptive credibility.

With AI tools at peak popularity and products like Claude generating massive search demand, attackers are capitalizing on this high-traffic, high-trust environment by using AI brands as bait.

Malvertising and legitimate ad campaigns follow nearly identical technical workflows: attackers must register ad accounts, bid on keywords, and submit landing pages for review. Platform automated review systems struggle to identify all malicious intent at the moment an ad goes live, which has given rise to well-established evasion tactics — attackers initially submit compliant landing page content, then switch to malicious content after approval, or use server-side geo/device detection to show benign pages to review crawlers while serving attack content to real users.

The abuse of Bing redirects exploits the search engine's "tracking redirect" mechanism: to measure click data, Bing wraps links into intermediate URLs of the form bing.com/ck/a?.... The domain visible to users and some security tools is bing.com, while the actual destination address is hidden within the URL parameters — nearly impossible to detect with the naked eye.

Why AI Tools Have Become the New Lure

Attackers' choice to impersonate AI brands is no accident. As generative AI tools like ChatGPT and Claude have proliferated, users increasingly turn to search engines to find official portals, download clients, or browser extensions. Many users are unfamiliar with the official domains of these emerging products, leaving an opening for spoofed pages to exploit.

Attackers impersonate AI brands' official sites and combine that with ClickFix's "verification" or "fix" framing to precisely target users who are eager to start using these tools. This continues the established pattern of malvertising targeting popular software and browser updates — just with the hottest AI products substituted as the target.

From an attacker's return-on-investment perspective, AI tools are currently among the most attractive impersonation targets. On one hand, official desktop clients or standalone applications for Claude, ChatGPT, and similar products are not yet widely established, meaning users already rely on search engines or third-party channels to find access points — this inherent uncertainty in the acquisition path naturally favors phishing pages blending in. On the other hand, search volume for AI-related keywords is growing at explosive rates while ad click costs remain relatively low, allowing attackers to achieve high exposure at minimal cost.

Past high-profile lures have included: video conferencing software (Zoom, Teams) during the pandemic, crypto wallet and exchange clients during bull markets, and "cheats" or "trainers" for popular games. AI brands are simply the latest iteration of this long-standing pattern — the attack methodology itself has not fundamentally changed.

Protection Recommendations for Users and Organizations

For everyday users, a few basic principles can significantly reduce risk:

• Be wary of search ad placements: When accessing AI tool official websites, directly type the known official domain name rather than clicking on the ad links at the top of search results.
• Refuse to manually execute commands: Any webpage that asks you to copy a command and paste it into a terminal, Run dialog, or PowerShell to "fix a problem" or "complete verification" is almost certainly an attack signal — close the page immediately.
• Verify the final URL: Treat links containing redirect parameters with suspicion, and pay attention to the actual destination address after any redirect.

For enterprise security teams, strengthening endpoint behavioral monitoring, restricting ordinary users' permissions to execute scripts, and conducting social engineering awareness training for employees are key countermeasures against this type of hybrid attack.

Summary

This incident once again demonstrates that attackers are closely tracking technology trends to update their lure strategies, combining AI brand impersonation with established ClickFix techniques and malvertising. The focus of defense is not on any single technical block, but on recognizing the common characteristic of "inducing manual user action" — as long as users refrain from casually copying, pasting, and executing unfamiliar commands, the success rate of these attacks drops dramatically.

Note: This article is based on limited intelligence from the Hacker News community. The original source material is sparse; for specific attack details and affected scope, refer to subsequent disclosures from authoritative security vendors.