Plan
active
Malvertising campaign uses Bing redirects in Google Ads to push fake Claude ClickFix
- Engineer — Learn: ClickFix via AI-tool search ads is a growing supply-chain entry point for endpoints; no patch needed, but reinforce approved-software-only policies and consider blocking known malicious installer domains once IOCs are published.
- SOC/IR — Plan: ClickFix attacks produce detectable behavior — PowerShell or mshta spawned from browser or fake-installer processes; build or tune Sigma/EDR rules for that parent-child chain to catch this and future ClickFix campaigns without waiting for campaign-specific IOCs.
- Leader — Learn: Malvertising targeting popular AI-tool searches is a rising awareness gap; useful context for refreshing user guidance on approved software procurement, but no immediate board-level or vendor-exposure action required.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.