Hackers Are Hijacking Bing Redirects to Spread Fake Claude Installers

Emily Davis · 2026-10-09

You know that sinking feeling when you click what looks like a normal search ad and something feels... off? That's exactly what's happening right now, and it's worth paying attention to. Security researchers have spotted a sneaky new campaign where hackers are using legitimate Bing search-result redirects as the click URLs inside Google search ads. The whole thing points people toward fake Claude installers — and those installers are loaded with ClickFix attacks. ### What's Actually Going On Here Here's the trick in plain English. When you click a Google ad, you expect to land on a real business page. Instead, the ad quietly routes you through a genuine Bing redirect link. Because that Bing URL is legit, it sails past a lot of the usual suspicion — both yours and whatever security tools you've got running. Once you land on the fake installer page, you're told to fix something by copying and pasting a command into your terminal. That's the ClickFix move. It looks technical, it looks official, and it fools a surprising number of smart people. ### Why This One Is Tricky Most phishing attempts have tells. Weird domains. Broken grammar. This one doesn't play that game. - The redirect comes from a real, trusted search engine - The ad appears inside Google's own results - The landing page mimics a well-known AI tool - The instructions feel like something a real developer would do That combination is why people keep falling for it. ### The Bigger Lesson About Trust As someone who spends my days thinking about digital privacy and browser security, I'll say this plainly: trust is the vulnerability here, not technology. We've been trained to trust search results. We've been trained to trust that a redirect from a major platform means something. Hackers know this, and they're exploiting it. > "The most dangerous attacks aren't the ones that break your defenses. They're the ones that convince you no defense is needed." ### How to Protect Yourself You don't need a security degree to stay safe. You need a few habits. - Never paste commands into your terminal from a webpage you just landed on - Type official tool URLs directly instead of clicking ads - Use an antidetect browser or a hardened browser profile for sensitive work - Slow down when a page rushes you into "fixing" something ### Where Antidetect Browsers Fit In If you're juggling multiple accounts, running campaigns, or doing research across platforms, an antidetect browser gives you isolated profiles that don't leak signals between sessions. That matters here because these attacks often rely on fingerprinting to decide who to target. When each profile looks like a clean, separate machine, you're a much harder target to profile and follow. ### The Takeaway This campaign isn't groundbreaking in its tech. It's clever in its psychology. It borrows trust from Google and Bing, then hands you a fake installer and a command to run. The fix is simple: trust less, verify more, and never run code you didn't ask for. That one rule alone would stop most of these attacks cold.