Security/shipped/2026-10-13

Fake AI Model Installation Pages Deliver Malware via Google Ads

Malicious actors are leveraging Google Ads to direct users, particularly Mac users and developers, to fake installation pages for AI models like Claude and ChatGPT. These deceptive pages are designed to deliver malware. Security outlets report on the surge of these attacks, with one identifying "ClickFix" as a method used in malware delivery.

3 articles from 3 outlets covered this story. Their coverage differs on 3 points. The underlying claim is sourced from a shipped.

What do all outlets agree on?

3 outlets covered “Fake AI Model Installation Pages Deliver Malware via Google Ads”. All of them report the following:

  • Malicious actors use fake AI model installation pages
  • These pages deliver malware
  • Google Ads are a vector for these attacks
  • Mac users are among the targets

Did outlets disagree about this?

Yes. Coverage of “Fake AI Model Installation Pages Deliver Malware via Google Ads” differs on 3 points. Each account below is how a different outlet described the same event:

Attacks target both Claude and ChatGPT users

Dark Reading (includes ChatGPT) vs. eSecurity Planet, Security Boulevard (focus only on Claude)

Malware was delivered via "ClickFix"

Security Boulevard (mentions "ClickFix") vs. eSecurity Planet, Dark Reading (do not mention "ClickFix")

Attacks are surging

Dark Reading (states "Attacks Surge") vs. eSecurity Planet, Security Boulevard (report on incidents without explicitly stating a surge)

Which outlets covered this?

All 3 articles found on this story, grouped by the stance of the piece. Every link goes to the original publisher.

What related stories are there?

Which companies does this involve?

Get the week in AI in one email

What happened, which outlets reported it, and where their coverage differed. One issue a week.

The first issue hasn’t gone out yet. Subscribe and it’s the one you’ll get.

We’ll send the digest and nothing else. One-click unsubscribe. Privacy.