Posted on

Adception Claude macOS ClickFix Malvertising — Sentinel Hunts

Threat Overview

Push Security published October 9 research into an active malvertising chain it calls “Adception.” A sponsored Google search result for “claude mac” displayed a trusted Bing destination. Clicking routed through Google advertising and Bing `/ck/a` tracking to a compromised WordPress retailer, then to a counterfeit Claude installer at `claude-desk-code.com`. The campaign used referrer/header checks and JavaScript cloaking so direct visits or automated checks could see benign or 404 content. The fake page visibly presented Anthropic's legitimate install command, but its copy button placed a different shell command on the clipboard: the command decoded a base64 URL for `lake-90.com`, fetched a `.dat` file with curl, and piped its contents to macOS zsh. Push Security observed the delivery technique; the final downloaded payload and malware family have **not** been confirmed. This targets employees adopting AI tools and demonstrates trusted-domain redirection plus ClickFix-style terminal execution.

References

Impacted Systems

Target environment: macOS desktops/laptops used to search for and install Claude/Claude Code via web browser and Terminal; Google Ads and Bing click redirects, compromised WordPress intermediary, attacker-hosted fake installer. This is a social-engineering campaign, not a verified vulnerability in Claude, macOS, Google, Bing, or WordPress generally. No affected software version/build or fixed version exists. Prerequisites: user encounters campaign ad, follows cloaked redirect chain, copies/pastes and executes the substituted shell command. Exposure: outbound HTTPS/web access to the campaign sites and terminal execution privileges of the user. Windows compromise from this specific chain is not confirmed.

Why this matters

The campaign combines trusted search-engine redirects, AI-brand impersonation, clipboard substitution, and terminal execution; it applies broadly to organizations with macOS/developer users.

Exploitation Status

Confirmed observed malvertising/ClickFix delivery chain by Push Security (October 9); successful installation of a specific malware family and post-compromise impact have not been established in the cited research.

What this hunt looks for

Layered behavioral and infrastructure searches covering: First pass — macOS curl piped into zsh or bash; Reported fake Claude and payload-host network connections; Proxy/firewall URL visibility across Bing redirect and fake Claude site; Shell command lines with base64-decoded remote payload execution; Browser-to-terminal execution chain on macOS; Downloaded DAT payloads and suspicious file origin; Syslog fallback for macOS curl-to-shell or campaign domain; Rare destinations contacted by shell or curl processes; Process-to-network correlation for confirmed campaign destinations.

Required logs

CommonSecurityLog, DeviceFileEvents, DeviceNetworkEvents, DeviceProcessEvents, Syslog

Hunt 1: First pass — macOS curl piped into zsh or bash

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("zsh","bash","sh","Terminal","curl")
| where ProcessCommandLine has "curl" and (ProcessCommandLine has "zsh" or ProcessCommandLine has "bash" or ProcessCommandLine has "| sh")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, FolderPath
| order by TimeGenerated desc

Hunt 2: Reported fake Claude and payload-host network connections

DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl has_any ("claude-desk-code.com","lake-90.com")
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, ActionType
| order by TimeGenerated desc

Hunt 3: Proxy/firewall URL visibility across Bing redirect and fake Claude site

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| where Url has_any ("claude-desk-code.com","lake-90.com") or (Url has "bing.com/ck/a" and Url has "claude")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, Url, DeviceAction, DeviceVendor, DeviceProduct
| order by TimeGenerated desc

Hunt 4: Shell command lines with base64-decoded remote payload execution

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("zsh","bash","sh","osascript","curl")
| where ProcessCommandLine has_any ("base64","-D","--decode") and ProcessCommandLine has_any ("curl","zsh","bash","sh")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Hunt 5: Browser-to-terminal execution chain on macOS

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("zsh","bash","sh","Terminal","iTerm2")
| where InitiatingProcessFileName in~ ("Google Chrome","Safari","Firefox","Arc","Terminal","iTerm2")
| where ProcessCommandLine has_any ("curl","bash","zsh","lake-90","base64")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Hunt 6: Downloaded DAT payloads and suspicious file origin

DeviceFileEvents
| where TimeGenerated >= ago(30d)
| extend Origin=tostring(column_ifexists("FileOriginUrl",""))
| where Origin has "lake-90.com" or (FileName endswith ".dat" and InitiatingProcessFileName in~ ("curl","zsh","bash"))
| project TimeGenerated, DeviceName, FileName, FolderPath, Origin, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType
| order by TimeGenerated desc

Hunt 7: Syslog fallback for macOS curl-to-shell or campaign domain

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("claude-desk-code.com","lake-90.com") or (SyslogMessage has "curl" and SyslogMessage has_any ("zsh","bash","base64"))
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Hunt 8: Rare destinations contacted by shell or curl processes

let Baseline=DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("curl","zsh","bash","sh")
| summarize by DeviceId, RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("curl","zsh","bash","sh")
| join kind=leftanti Baseline on DeviceId, RemoteUrl, RemoteIP
| summarize FirstSeen=min(TimeGenerated), Connections=count(), Processes=make_set(InitiatingProcessFileName,5) by DeviceName, RemoteUrl, RemoteIP
| order by FirstSeen desc

Hunt 9: Process-to-network correlation for confirmed campaign destinations

let Procs=DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where FileName in~ ("curl","zsh","bash","sh")
| project DeviceId, ProcessId, StartTime=TimeGenerated, FileName, ProcessCommandLine;
DeviceNetworkEvents
| where TimeGenerated >= ago(14d)
| where RemoteUrl has_any ("claude-desk-code.com","lake-90.com")
| join kind=inner Procs on DeviceId, $left.InitiatingProcessId == $right.ProcessId
| where TimeGenerated between (StartTime .. StartTime + 2h)
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, RemoteUrl, RemoteIP, RemotePort
| order by TimeGenerated desc

Detection Notes

  • Highest signal: contact with published fake/payload domains together with curl-to-zsh or decoded shell command execution.
  • The Bing `/ck/a` endpoint is legitimate; its appearance alone is not suspicious.
  • The displayed legitimate Anthropic install command is not an IOC; the malicious clipboard substitution requires browser or shell visibility to identify.
  • Curl-piped scripts may never create a file on disk; absent DeviceFileEvents matches are not reassuring.
  • No final malware payload was confirmed by the cited research, so do not infer infostealer, persistence, or credential theft as observed outcomes.

Leave a Reply