ClickFix Campaign Turns Google Ads, GitLab, and Claude Into a Six-Wave Trust Machine

Key points

• TrendAI researchers tracked a six-wave ClickFix campaign running from early April through mid-June 2026, reaching more than 2,000 victims via sponsored Google search results.
• Attackers impersonated ChatGPT Codex, Perplexity, Cursor IDE, JetBrains and Claude AI across 92 unique GitLab hostnames.
• Waves five and six abandoned GitLab entirely, weaponising claude.ai's own share feature to host lures on a fully trusted domain.
• A compromised developer machine typically holds session cookies, SSO tokens, SSH keys, cloud CLI tokens and Git credentials: enough to move laterally without ever touching a password.
• Reputation-based defences couldn't flag the attack because every domain in the chain was legitimate.

What actually happened here?

The attack didn't need a sketchy domain. That was the point.

TrendAI documented a six-wave campaign that funnelled victims from sponsored Google search results into a chain built on reputable infrastructure. ClickFix is the social-engineering pattern underneath it all: victims are instructed to copy and paste a PowerShell or terminal command themselves. No drive-by exploit. The user runs the payload, which sidesteps endpoint detection watching for process injection rather than a developer typing into their own shell.

The first wave launched between 8 and 13 April, with a single Google Ads campaign ID (23736589328) driving most of the traffic to pages like claude-code-app.gitlab[.]io. Weekly waves rotated new GitLab subdomains and keywords to stay ahead of blocklists across 92 unique hostnames in total.

Waves five and six are where the architecture gets interesting. Operators dropped GitLab and started using claude.ai's built-in share feature, creating persistent public URLs on a domain that nearly every organisation whitelists. Google Ads then sent victims straight to those weaponised pages. The AI interface itself appeared to give instructions, and developers accustomed to asking AI tools for technical guidance complied.

Should you worry about trust stacking?

This is the same threat pattern we've tracked across CI/CD pipelines since May: individually legitimate layers that only reveal a chain when you trace the full path. Most reputation-based defences never do. Amit Jaju, senior managing director at Ankura Consulting, told CSO Online the chain "borrows trust from familiar brands, legitimate ad infrastructure, reputable hosting, and an AI platform that many developers already use."

For identity and access teams, the session-token angle is the sharpest edge. A valid unexpired token doesn't trigger an authentication challenge; the identity provider already considers that session live. Phishing-resistant passkeys at the IdP wouldn't have helped anyone who handed over a post-auth token.

What should defenders actually do?

Blocking Google, GitLab, or Anthropic domains isn't a realistic option. Devroop Dhar, co-founder and India CEO at Primus Partners, told CSO Online that defenders need to shift focus from domain reputation to behaviour: limit unnecessary administrative privileges on developer machines, monitor shell and PowerShell execution for anomalous calls, and segment high-privilege engineering workflows from general browsing. Developer endpoints deserve the same scrutiny as a domain controller. That's not yet the default anywhere.