A recent malware campaign has been identified that exploits the popularity of Anthropic's Claude Code by using malicious Google-sponsored advertisements to redirect users to a counterfeit documentation website. The attackers leverage the ClickFix social engineering technique to persuade users to execute malicious PowerShell or terminal commands, resulting in the installation of credential-stealing malware on Windows systems and a remote access backdoor on macOS devices. Rather than exploiting software vulnerabilities, the campaign relies on user trust in search advertisements and legitimate-looking documentation. Organizations should reinforce user awareness, verify software download sources, restrict the execution of unauthorized scripts and system utilities, and implement endpoint security controls that detect and block such threats.
The attack begins with a malicious Google Ads campaign that impersonates Claude Code, directing users searching for the software to a counterfeit documentation page hosted on a legitimate Squarespace subdomain. The fake site closely replicates the appearance and content of the official Claude documentation, making it difficult for users to distinguish it from the legitimate resource. Based on the visitor's operating system, the page presents tailored installation instructions that leverage the ClickFix social engineering technique, instructing users to manually execute malicious PowerShell, Command Prompt, or terminal commands under the guise of installing Claude Code.
On Windows systems, the provided command abuses the legitimate mshta.exe utility to retrieve and execute a multi-stage malware payload, ultimately deploying credential-stealing malware detected as Trojan.Stealer.GJ, Trojan.Stealer.GK, IL:Trojan.MSILZilla.245316, and Gen:Variant.Barys.509034. On macOS, the attack uses obfuscated shell commands to decode Base64-encoded content, download a Mach-O binary, and execute a backdoor that can spawn remote shell sessions via/bin/bash or /bin/zsh, enabling attacker-controlled remote command execution. The malware employs multiple layers of obfuscation, anti-analysis techniques, and staged payload delivery to evade detection while establishing persistent remote access to compromised systems. The details and technicalities of the attack campaign are discussed further below.
Delivery and Infection Chain:
The attack is delivered through a malvertising campaign that abuses Google Ads to impersonate the legitimate Claude Code documentation website. Users searching for terms such as "download Claude Code" are presented with a sponsored advertisement that redirects them to a counterfeit documentation page hosted on a trusted Squarespace subdomain. The website closely mimics the official Claude documentation, including its branding, layout, and installation instructions, increasing the likelihood that users will trust the content. Rather than exploiting software vulnerabilities, the attackers rely entirely on social engineering, convincing users to manually execute malicious commands under the pretext of installing the software.
The infection chain was identified as follows:
Technical Capabilities:
The malware demonstrates several advanced capabilities designed to facilitate compromise and evade detection. On Windows, it employs mshta.exe as a Living-off-the-Land Binary (LOLBin) to bypass traditional security controls while executing multi-stage payloads that decrypt embedded Microsoft Intermediate Language (MSIL) code before delivering credential-stealing malware. On macOS, the malware uses multiple layers of Base64 encoding, compressed payloads, string obfuscation, and anti-analysis techniques, including anti-sandbox and anti-virtual machine checks. The final Mach-O payload functions as a backdoor capable of spawning /bin/bash or /bin/zsh shells, enabling remote command execution, system reconnaissance, payload deployment, and potential data exfiltration.
Attribution and Evolution:
Current analysis indicates that the campaign was facilitated through a compromised legitimate Google Ads advertiser account associated with a Malaysian organization, allowing the attackers to publish malicious advertisements that appeared trustworthy to users. There is currently no public attribution linking the operation to a specific threat actor or advanced persistent threat (APT) group. The campaign reflects an evolving trend in cybercrime, where threat actors increasingly exploit the popularity of artificial intelligence platforms and developer tools to increase the success of phishing and malware distribution campaigns. The use of trusted advertising platforms, counterfeit documentation, and platform-specific payloads demonstrates a high level of operational planning and adaptability.
Active Campaign and Geographic Spread:
At the time of publication, the campaign was observed targeting users globally through Google Search advertisements, with no evidence of country-specific targeting. Because the malicious advertisements appear in response to common search queries for Claude Code, any individual or organization searching for the software may be exposed. The attack specifically targets both Windows and macOS environments, indicating a broad victim profile that includes developers, IT professionals, researchers, and general users. Following responsible disclosure, the identified malicious advertiser account was reportedly disabled by Google. However, similar campaigns leveraging compromised advertising accounts and impersonated software documentation remain an ongoing threat.
Conclusion:
This campaign demonstrates that modern malware attacks increasingly rely on social engineering rather than software vulnerabilities, exploiting user trust in sponsored search results, well-known brands, and seemingly legitimate documentation. The abuse of trusted platforms such as Google Ads, coupled with operating system-specific malware and the use of legitimate system utilities, significantly increases the effectiveness of the attack while reducing the likelihood of detection. Organizations should strengthen user awareness, enforce secure software acquisition practices, restrict the execution of unauthorized scripts and command-line interpreters where feasible, and deploy Endpoint Detection and Response (EDR) solutions capable of identifying suspicious behaviors associated with this attack chain.
Successful exploitation can result in the compromise of sensitive organizational and personal information. On Windows systems, the malware is capable of stealing credentials and other valuable data through multi-stage information-stealing payloads. On macOS, the installed backdoor provides attackers with persistent remote access, allowing them to execute arbitrary commands, deploy additional malware, conduct lateral movement, harvest credentials, and exfiltrate sensitive information. The compromise of privileged accounts or developer workstations may further increase the risk of unauthorized access to enterprise environments, cloud services, and software development resources.
https://www.bitdefender.com/en-us/blog/labs/fake-claude-code-google-ads-malware
https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html
