The Copy button is lying to you

This one is clever. And a bit nasty.

You search Google for "claude mac". You see an ad. You click. You land on a page that looks exactly like the real Claude download page, with a terminal command to install it. And the command you SEE is the real one from Anthropic.

But the Copy button puts a different command in your clipboard. You paste it in Terminal, press enter, and a script from some random domain runs on your Mac. Done.

Push Security found it, NSFOCUS wrote it up on Security Boulevard this week if you want the technical part: https://securityboulevard.com/2026/10/ai-security-incident-case-fake-claude-installation-page-delivered-malware-via-clickfix

The ad even showed bing.com as the landing domain, so the reviewers saw nothing wrong. And the fake page shows a 404 to anyone who doesn't arrive from the ad. So scanners see nothing too.

BTW - this is not really about Claude. Tomorrow it will be "ChatGPT for Windows" or some new AI video tool everyone wants to try. Everyone is installing AI tools right now. Criminals know it.

So two small habits. Download from the official site you typed yourself, NOT from an ad. And before you press enter, paste the command somewhere you can actually read it. If there is a weird domain and "| zsh" or "| bash" at the end, stop.

Copy, paste, regret. Be careful guys :)