Hackers are abusing legitimate Bing click-tracking redirects embedded in Google Ads to push fake Claude installers that execute ClickFix attacks. Security researchers labeled the technique "Adception." A sponsored Google ad points to bing.com/ck/a, which forwards users to a compromised WordPress retailer site and then to a fake claude-desk-code.com download page. Because the visible ad destination is bing.com, the ad bypasses advertising security checks and appears trustworthy. Bing's JavaScript-based click tracking lets attackers forward users while making the traffic look like it originates from Bing.
The operation uses multi-layer cloaking: the compromised WordPress site checks for a Bing referrer and specific headers before redirecting, and the fake Claude page verifies arrival from Google or Bing and returns a 404 to direct visitors or scanners. The fake installer displays Anthropic’s legitimate curl command, but the copy button places a malicious Base64-decoded command into the clipboard that fetches a .dat file from an attacker server (lake-90.com) and pipes it to zsh for execution. Researchers tied multiple domains with an identical macOS installer pattern to a ClickFix toolkit tracked as AcSig; the final payload remains unknown, but the campaign creates a covert, ad-driven macOS execution vector that evades normal scanning and trust signals.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Vinay Prasad criticizes Terrence Tao's view that patients need human understanding before accepting AI-derived cancer cures, arguing that many cancer drugs lack fully understood mechanisms yet are still used. He emphasizes that positive phase 3 trial results can be enough for treatment, regardless of complete mechanistic knowledge, highlighting the urgency and desperation in cancer treatment decisions. (drvinayprasad.com)
The US Justice Department is investigating ABC, CBS, CNN, NBC, and Fox News for potentially violating federal competition laws by suspending White House pool coverage of Donald Trump. The networks temporarily stopped sharing footage after Trump blocked certain outlets from covering events. (bbc.com)
The U.S. Supreme Court considered a case involving alleged breaches by Intel fiduciaries for investing in hedge funds and private equity in 401(k) plans. A ruling favoring Intel could encourage more employers to include alternative investments in retirement plans, despite potential slow adoption by large companies. (cnbc.com)
UK water companies earned over £340 million last year by processing industrial and commercial wastewater at sewage plants that do not effectively remove chemical pollutants. Experts say this practice allows harmful pollutants to flow into rivers, seas, and farmland, raising environmental concerns. (theguardian.com)
A raw goat milk farm in California sold unpasteurized milk that sickened two children, including a 17-month-old girl. Regulators did little to penalize the farm despite evidence of violations and health risks. (propublica.org)
A Denver woman is suing police, Flock Safety, and two Colorado towns after being falsely accused of stealing a package based on surveillance footage. She claims the warrantless tracking violated her constitutional rights and was unjustified. (coloradosun.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.