Push Security’s October 9 investigation describes a Google advertisement for a macOS Claude download that routed visitors through a Bing search link and a compromised retail website. The final destination imitated a software installation page.
The company found that the page’s copy button substituted a different terminal command from the text shown on screen. Redirect checks also limited which visitors reached the malicious content. This is evidence of an installation lure and deceptive delivery chain, not evidence that the legitimate Claude application itself was compromised.
NAOAT analysis
The practical lesson for employers concerns the route from a software request to an approved installation. Asking employees to recognize every suspicious domain places the decision at the point where the attacker controls much of what they see. A maintained internal software catalog can move that decision earlier, when a team can establish the official source and document a supported installation method.
That process should be convenient enough to use. If obtaining an ordinary work tool requires several days and an unclear approval chain, employees have a strong incentive to find another route. A useful service measure would track how quickly legitimate requests reach a working installation, alongside the number of exceptions requiring investigation.
Training can then concentrate on the unexpected transition: a download request that suddenly asks someone to paste a command into a terminal. Staff need a simple way to stop and contact support without fearing that they have already done something wrong. For investigators, the employee’s account of the full browsing sequence can be valuable even when the final page no longer behaves the same way. The goal is to make verified software delivery an ordinary business service, with a clear recovery path when something unusual appears.