Criminals are buying search ads for fake Claude and Codex downloads

What happened

Criminals are buying search ads that lead to fake download pages for AI tools like Claude Code and OpenAI's Codex, says Push Security, which sells security tools. The pages tell you to copy a command and paste it into your computer, and that command installs harmful software. In one case, the page showed the real Claude install command, but its copy button swapped in a different one. Microsoft says this wider family of tricks, called ClickFix, grew roughly 23x overall between December 2025 and May 2026, though Push says AI-themed versions are only about 5% of the attacks it catches.

What's actually going on

Some AI tools, like Claude Code, install when you paste one line into the terminal, the plain text window where you type commands straight to your computer. So people who never touched a terminal now copy commands from web pages as a normal step. That's the AI part of this story: a scammer no longer has to invent a reason for you to paste something. You arrive expecting to, and they just swap the command. Many people also find AI apps by searching the name, and Push says 4 in 5 ClickFix pages it caught in 2026 were reached from search engines.

The fake pages are built to survive a careful look. In one case Push studied, a Google search for "claude mac" showed a sponsored result displaying bing.com as its address, which made the ad look like it came from a trusted company. The fake page showed the real install command, but its copy button put a different one on your clipboard. That command printed a real claude.ai address on screen, then quietly downloaded and ran a hidden set of instructions.

Scammers also hide lures on the AI sites themselves, in shared chats on ChatGPT and Claude. One custom GPT, a version of ChatGPT that anyone with a paid account can build and steer with hidden instructions, answered everything with a fake outage notice linking to a page that pushed a ClickFix attack on Windows users. Push says it had more than 10,000 conversations. Since the lure sits on chatgpt.com or claude.ai, security tools that decide a link is safe because it's on a well-known site have every reason to trust it.

In your life

If anyone in your house is trying out AI tools, this is one trick worth knowing about, since it waits right where people search. The paste-a-command version mostly targets people installing tools like Claude Code, while everyday chatbot users are more likely to run into a bad link inside a shared chat. My rule of thumb: a web page or chatbot asking you to paste something into your computer is a red flag.

Be careful about

Push Security wrote and paid for this article, and it sells protection against these attacks, so weigh its numbers with that in mind. The bigger worry: checking the page may not help. The fake can show the real command and even print the real claude.ai address.

Where to get it

There's nothing to get. One small step: bookmark the real sites, like chatgpt.com and claude.ai, and open them from your bookmarks instead of searching. If you do search, skip results marked sponsored, whether you use a Mac or a Windows PC, since both are targeted.