← Sunday, October 11, 2026SecurityNews

Attackers use trusted Bing redirects to deliver fake Claude installers

bleepingcomputer.com 3 min read Editor score 6/10

The campaign routes Google ad clicks through Bing redirects and a compromised site to fake Claude installers, using cloaking to hide the payload from scanners. It illustrates how trusted redirect chains can complicate defenses against malvertising.

What: Attackers used Google search ads and Bing redirects to send users to a fake Claude installer through a compromised WordPress website.
How: The fake site checked referrers and browser headers; its copy button substituted a command that fetched a script from an attacker-controlled server.
Why it matters: Engineers should treat trusted redirect chains and copied installation commands as potential supply-chain risks; the final payload was unknown.

The attack redirects ad traffic through compromised and fake sites before fetching a script. Sketched from the article's own text.

Read on bleepingcomputer.com → Hacker News · 8 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.