{"$schema": "https://iptc.org/std/ninjs/ninjs-schema_3.2.json", "uri": "urn:newsml:wireva.mib.news:item:7e78b803-2592-4f2f-991b-45acafd3e58d", "type": "text", "profile": "update", "version": "1", "versioncreated": "2026-10-17T14:05:17.075604Z", "firstcreated": "2026-10-17T14:01:08.322274Z", "pubstatus": "usable", "urgency": 5, "language": "en", "headline": "Hackers Use Google Ads and Bing Redirects to Spread Fake Claude Installer", "byline": "Gavin Kendall", "located": "United States", "copyrightholder": "Haydamax OÜ", "copyrightnotice": "Wireva / Cronkite", "usageterms": "Subscribers may republish this item in full, including translation and trimming, with the credit “Wireva / Cronkite”. Set rel=canonical to https://cronkite.online/news/hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer/ when publishing on the web.", "description_text": "Security researchers at Push Security have uncovered a scheme that hides a malicious fake Claude download behind sponsored Google search results and legitimate Bing redirect links, using a clipboard-swapping trick to get Mac users to run dangerous commands.", "altids": {"mosaic": "7e78b803-2592-4f2f-991b-45acafd3e58d", "story": "1f638e34-c0cd-4c29-a6fa-5d3ceadd0708", "slug": "hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer"}, "subject": [{"name": "General news", "rel": "direct", "literal": "general", "code": "medtop:11000000", "scheme": "http://cv.iptc.org/newscodes/mediatopic/", "uri": "http://cv.iptc.org/newscodes/mediatopic/11000000"}], "place": [{"name": "United States", "literal": "us", "code": "US", "scheme": "http://cv.iptc.org/newscodes/countrycodes/"}], "person": [], "organisation": [], "genre": [{"name": "Updated story", "literal": "update"}], "service": [{"name": "Wireva", "literal": "wireva"}], "associations": {"featuremedia": {"uri": "urn:newsml:wireva.mib.news:media:760af847-1c5c-48bf-8d5e-27a1b5587ba3", "type": "picture", "version": "1", "pubstatus": "usable", "headline": "Hackers hide dangerous fake AI downloads behind Google ads", "description_text": "Hackers Use Google Ads and Bing Redirects to Spread Fake Claude Installer", "copyrightholder": "a57.foxnews.com", "copyrightnotice": "Hackers hide dangerous fake AI downloads behind Google ads", "usageterms": "Picture belongs to the source publication: address and terms are delivered, the file is not.", "altids": {"wireva": "760af847-1c5c-48bf-8d5e-27a1b5587ba3"}, "extra": {"wireva:delivery_mode": "link_only", "wireva:rights": {"licence": "", "licence_url": "", "licence_raw": "RSS source", "licence_verified_at": "2026-10-17T14:05:17.098855Z", "attribution_required": true, "attribution_text": "Hackers hide dangerous fake AI downloads behind Google ads", "redistribution_allowed": false, "commercial_use_allowed": false, "modifications_allowed": false, "share_alike_required": false}, "wireva:provenance": {"creator": "", "source_name": "a57.foxnews.com", "source_url": "https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2026/10/931/523/AI-Hackers-Photo-1.jpg?ve=1&tl=1", "source_page_url": "https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2026/10/931/523/AI-Hackers-Photo-1.jpg?ve=1&tl=1", "our_page_url": "https://cronkite.online/news/hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer/"}, "wireva:role": "lead"}, "renditions": {"source": {"href": "https://a57.foxnews.com/static.foxnews.com/foxnews.com/content/uploads/2026/10/931/523/AI-Hackers-Photo-1.jpg?ve=1&tl=1", "mimetype": "image/jpeg"}}}}, "extra": {"wireva:story": {"uri": "urn:newsml:wireva.mib.news:story:1f638e34-c0cd-4c29-a6fa-5d3ceadd0708", "slug": "story-20261017-31", "status": "updated", "languages": ["de", "en", "fr", "nl", "sv", "uk"], "item_count": 22, "is_breaking": false}, "wireva:rights": {"class": "agency_original", "redistribution_allowed": true, "commercial_use_allowed": true, "modifications_allowed": true, "share_alike_required": false, "attribution_required": true, "attribution_text": "Wireva / Cronkite", "canonical_required": true, "canonical_url": "https://cronkite.online/news/hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer/", "linkback_required": true, "licence": "Wireva subscriber licence", "licence_url": "", "licensor": "Haydamax OÜ", "valid_until": null, "excerpt_max_chars": 0, "decided_by_rule": "agency_original_verified", "needs_review": false}, "wireva:provenance": {"production_method": "automated", "ai_stages": {"editing": true, "drafting": true, "headline": true, "discovery": true, "classification": true, "image_selection": true, "source_collection": true, "cross_source_comparison": true}, "model": "", "human_reviewed": false, "reviewed_by": "", "reviewed_at": null, "editorial_control": true, "editorial_responsibility": "Haydamax OÜ (Wireva)", "factchecked": false, "verification_status": "multi_source", "independent_confirmations": 4, "official_source_used": false, "used_press_release": false, "public_interest": true, "ai_disclosure_required": true, "ai_disclosure_text": "This item was produced with AI assistance under the editorial responsibility of Haydamax OÜ.", "independence_check": {"status": "passed", "score": 0.138, "checked_at": "2026-10-17T14:05:17.095002Z"}}, "wireva:publication": {"name": "Cronkite", "domain": "cronkite.online", "country": "US", "url": "https://cronkite.online/news/hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer/"}, "wireva:links": {"self": "https://wireva.mib.news/api/v1/items/7e78b803-2592-4f2f-991b-45acafd3e58d", "html": "https://wireva.mib.news/item/7e78b803-2592-4f2f-991b-45acafd3e58d/hackers-use-google-ads-and-bing-redirects-to-spread-fake-claude-installer/", "story": "https://wireva.mib.news/story/story-20261017-31/"}, "wireva:metrics": {"word_count": 667, "char_count": 4565, "reading_time_seconds": 326}}}