Push Security (Organization): news timeline & CVEs

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Hackers use Google Ads and Bing redirects to deliver fake Claude installers that run ClickFix commands.

Push Security reported hackers using Google ads whose destinations are legitimate Bing click-tracking URLs, which then redirect through a compromised South American retailer’s WordPress site to claude-desk-code[.]com. The fake macOS Claude page displays Anthropic’s real install command, but the copy button substitutes a Base64-decoded curl that fetches a script from lake-90[.]com and pipes it into zsh. Referrer and header cloaking sends direct visitors and scanners to a 404. The final payload is unknown; Push tracks the shared ClickFix toolkit as AcSig.

BleepingComputerOct 9, 20:31 UTC · 1d agoPhishing & fraud in the wild

Know Your Enemy: Browser-Based Attack Techniques in 2026

Push Security survey details six dominant browser attack techniques for 2026, including AiTM phishing, ClickFix, OAuth abuse, and session hijacking.

The article outlines six browser-based attack trends: AiTM reverse-proxy phishing kits (Tycoon2FA, Sneaky2FA, Evilginx) that steal live session tokens bypassing MFA; ClickFix malicious copy-and-paste attacks, identified by Microsoft as the top initial access vector at 47% and 52% of Push Q2 2026 detections; OAuth authorization phishing via consent grants and device code flows that defeats passkeys; malicious and AI browser extensions creating exfiltration paths; ghost logins outside SSO fueling credential stuffing; and session hijacking from infostealer-derived tokens. It cites Verizon DBIR 2026 finding 15% of corporate users with unauthorized AI extensions and 46% of infostealer breach infections originating on non-managed devices.

The Hacker NewsSep 30, 11:58 UTC · 10d agoResearch1

Push Security

Timeline2 articles

Appears with

Hackers abuse Google Ads, Bing redirects to push Claude ClickFix attacks

Know Your Enemy: Browser-Based Attack Techniques in 2026