Full Report
Bitdefender’s security researchers have discovered a malicious Google Ads campaign targeting anyone searching for downloads related to Claude, the large language model developed by Anthropic.
Analysis Summary
# Tool/Technique: ClickFix Claude Code Impersonation Campaign
## Overview
This malicious campaign utilizes Google Ads to target developers and AI enthusiasts looking for Anthropic’s "Claude Code" tool. Attackers use the **ClickFix** social engineering technique to trick users into executing system commands that deploy info-stealers on Windows and a Mach-O backdoor on macOS.
## Technical Details
- **Type:** Malware Family (Stealers/Backdoors) and Delivery Technique (ClickFix)
- **Platform:** Windows, macOS
- **Capabilities:** Credential theft (stealer), remote command execution (backdoor), multi-stage payload decryption.
- **First Seen:** March 2026 (Reported date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1589.002 - Search Victim-Owned Websites (Google Ads Poaching)]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1218.005 - System Binary Proxy Execution: Mshta]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1140 - Deobfuscate/Decode Files or Information]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Social Engineering (ClickFix):** Displays a fake "Claude Code" documentation page that mimics the official Anthropic UI. It presents "installation" commands that users copy/paste into their terminal.
- **Windows Infection:** Uses `mshta.exe` to execute a remote HTA file. This file recursively decrypts an MSIL (Microsoft Intermediate Language) stager in memory to drop a shellcode-based stealer.
- **macOS Infection:** Executes an obfuscated shell command involving Base64 decoding to download and run a Mach-O binary.
### Advanced Features
- **Dynamic Content:** The website detects the visitor's User-Agent to serve OS-specific malicious instructions.
- **Stealth Execution:** By using legitimate binaries like `mshta.exe` and standard shell commands, the attack avoids traditional "malicious file download" alerts.
- **Backdoor/Shell Access:** The macOS variant allows attackers to spawn `/bin/bash` or `/bin/zsh` for full remote control.
## Indicators of Compromise
### File Hashes
- **Trojan.Stealer.GJ / GK:** (Specific hashes not provided in article, but identified by these labels)
- **Microsoft MSIL Payload:** IL:Trojan.MSILZilla.245316
- **General Variant:** Gen:Variant.Barys.509034
### Network Indicators
- **C2/Payload Domains:**
- `download.active-version[.]com`
- `docs-claude[.]squarespace[.]com` (Example of the Squarespace subdomain used)
### Behavioral Indicators
- **Windows:** Execution of `mshta.exe` pointing to an external URL.
- **macOS:** Execution of `curl` or `wget` piped into `base64 -d` and subsequently into `sh` or `zsh`.
## Associated Threat Actors
- **Unknown:** The campaign leveraged a compromised advertiser account linked to a Malaysian company.
## Detection Methods
- **Signature-based:** Bitdefender detections: `Trojan.Stealer.GJ`, `Trojan.Stealer.GK`, `IL:Trojan.MSILZilla.245316`.
- **Behavioral detection:** Monitoring for `mshta.exe` making external network connections. Identifying shell commands that combine decoding (`base64`) with immediate execution (`| sh`).
- **Endpoint Monitoring:** Flagging any terminal command copied from a browser and immediately pasted into PowerShell or Terminal.
## Mitigation Strategies
- **User Education:** Train developers to never copy-paste "installation" commands from non-official documentation URLs.
- **URL Verification:** Check for official domains (e.g., `anthropic.com` or `claude.ai`) rather than Squarespace subdomains.
- **System Hardening:**
- Disable or restrict `mshta.exe` via AppLocker or Windows Defender Application Control (WDAC).
- Implement EDR policies to alert on anomalous shell execution chains.
- **Ad-Blocking:** Use reputable ad-blockers to filter out "Sponsored" results in search engines.
## Related Tools/Techniques
- **LummaStealer:** Often distributed via similar Google Ad campaigns.
- **ClickFix Technique:** A widespread tactic where sites claim a "root certificate" or "browser update" is missing to trick users into running commands.
- **SEO Poisoning:** The broader category of manipulating search results to deliver malware.