Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
AI Security Incident Case: Fake Claude Installation Page Delivered Malware via ClickFix
Excerpt
Overview On October 9, 2026, Push Security disclosed a malvertising campaign targeting Claude users. Attackers set the landing domain of a Google search ad to bing.com, leveraging Bing’s own click redirects and multi-layer cloaking to guide users to a counterfeit Claude download page and execute ClickFix-style attacks. Ad platform reviewers only saw bing.com. A compromised WordPress site used server-side checks to filter out non-compliant requests, while the cloned site…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | lake-90.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…