The Claude Code Trap: Bitdefender Unmasks Fake Google Ads Hijacking Developer Terminals

Bitdefender uncovered a malvertising campaign that spoofs Anthropic’s Claude documentation in sponsored search results to trick developers into executing terminal commands (a tactic called “ClickFix”). The fake pages host OS-specific payloads: on Windows, commands invoking mshta.exe fetch multi-stage credential stealers identified as Trojan.Stealer.GJ/GK; on macOS, obfuscated Base64-decoded shell commands install a Mach-O backdoor that provides remote reverse-shell control. Attackers used a compromised, previously trusted advertiser account to bypass ad scrutiny.