Adception Malvertising Campaign Abuses Search Engine Redirects

Summary

Attackers are using a new technique dubbed Adception, which abuses sponsored Google search ads to redirect users through legitimate search engine redirects, including Bing, and compromised websites before delivering malicious payloads. The approach helps evade traditional security scanners by presenting trusted domains during initial inspection. The campaign specifically targets users searching for Claude macOS installers through advanced social engineering and clipboard manipulation.

Investigation

The Push team uncovered a multi-stage redirect chain beginning with a Google ad for “claude mac” that led to a Bing search result. The chain then passed through a compromised South American retail website before reaching a fake Claude download page. Researchers found that final payload delivery relied on a deceptive “Copy” button that placed a malicious command into the user’s clipboard instead of the legitimate command shown on screen.

Mitigation

Organizations should deploy browser-based security controls capable of analyzing real-time session telemetry and inspecting redirect chains. Monitoring for suspicious clipboard activity and unexpected terminal command execution, particularly involving curl and zsh, is essential. Security teams should also enforce strict web filtering and avoid relying solely on URL reputation checks to detect multi-hop redirect attacks.

Response

When Adception activity is detected, security teams should isolate the affected endpoint to stop further script execution. Review the user’s terminal history and available clipboard activity to determine which command was executed. Perform a comprehensive forensic analysis of the endpoint to assess whether the lake-90[.]com payload resulted in persistent malware installation, credential theft, or additional compromise.

Simulation Execution

• Attack Narrative & Commands: The adversary is conducting an Adception campaign. They have successfully used a sponsored search ad to create a redirect link. When a search engine crawler (like Bingbot) visits the link, the infrastructure serves a specific redirect or a “cloaked” page (e.g., a 404 page or a specific decoy path) to hide the true malicious payload from the crawler’s inspection, while the end-user sees the phishing content. The simulation will mimic a Bingbot making a request to a bing.com/ck/a redirect URI and a request to the claude-desk-code decoy path.

• Regression Test Script:

  #!/bin/bash
  # Simulation Script for Adception Detection Validation
  # This script simulates two scenarios: 1. Redirect and 2. Cloaking
  
  echo "[*] Starting Adception Simulation..."
  
  # Scenario 1: Simulating the Redirection via Bing Redirect URI with Bingbot UA
  echo "[+] Simulating Redirection (T1584.002)..."
  curl -s -A "Mozilla/5.0 (compatible; Bingbot/2.0; +http://www.bing.com/bingbot.htm)" 
       "http://localhost/bing.com/ck/a?q=malicious_payload" 
       -o /dev/null
  
  # Scenario 2: Simulating the Cloaked Page access with Googlebot UA
  echo "[+] Simulating Cloaked Page (T1189)..."
  curl -s -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" 
       "http://localhost/claude-desk-code" 
       -o /dev/null
  
  echo "[*] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # No permanent artifacts are created by this curl-based simulation.
  # If files were created on the webserver, they should be removed:
  # rm -f /var/www/html/claude-desk-code
  echo "[*] Cleanup complete. No persistent artifacts found."