A trusted-looking link can lead elsewhere
A Fox News report by Kurt Knutsson describes a fake Claude download campaign that combines sponsored search results with redirects and misleading installation instructions. The report attributes the investigation to Push Security, which observed an advertisement displaying a Bing destination before visitors reached a counterfeit installer page.
According to the report, the route passed through legitimate advertising and click-tracking systems, then a compromised website. The attack therefore relied on the destination changing after the initial click. Seeing a familiar search-engine domain did not establish that the eventual download came from Anthropic.
The copied text differed from the display
The report says the counterfeit page displayed an installation instruction that appeared to refer to the legitimate software provider, but its Copy button placed a different command on the clipboard. That substituted instruction concealed an external destination and was designed to download and execute a remote script.
This article does not reproduce the malicious command or link to its delivery site. The relevant mechanism is the mismatch between what the page showed and what it copied. The report also describes checks that showed different content to some visitors, which can complicate attempts to reproduce what a victim encountered.
What is confirmed and what remains unknown
Fox News explicitly notes that the published research did not identify the final payload or establish what it did after execution. Claims that this particular campaign stole specific files or installed a named malware family would go beyond that account.
Google told CyberGuy it had suspended the associated advertiser accounts. Microsoft said Defender detects and blocks the indicators identified in the report. Those statements describe the companies' reported responses, rather than a guarantee that every malicious download attempt will be stopped.
Franklin's practical reading is to verify the software provider and the final download destination directly. Treat a search advertisement and a convincing page design as separate from that verification, particularly when a supposed desktop installer asks you to execute copied instructions.