ClickFix Campaign Turns Google Ads, GitLab, and Claude Into a Six-Wave Trust Machine
Attackers chained legitimate infrastructure across seven weeks to push malicious PowerShell commands to developers. Session tokens, SSH keys, and cloud credentials were the prize.
The attack did not need a sketchy domain. That was the point.
Researchers at TrendAI documented a six-wave ClickFix campaign that ran from early April through mid-June, funnelling more than 2,000 victims from sponsored Google search results into a chain built almost entirely on reputable infrastructure — Google Ads, GitLab Pages, and eventually Anthropic's own claude.ai shared-chat feature.
ClickFix is a social-engineering technique where victims are instructed to manually copy and paste terminal or PowerShell commands. No drive-by exploit. The user executes the payload themselves, which neatly sidesteps a lot of endpoint detection that watches for process injection rather than a developer typing into their own shell.
The campaign impersonated ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, and Claude AI across 92 unique GitLab hostnames. Early waves used a single Google Ads campaign ID (23736589328) to drive the majority of traffic to pages like claude-code-app.gitlab[.]io. Each weekly wave rotated new GitLab subdomains and keywords to stay ahead of blocklists.
The fifth and sixth waves are the most interesting part of the architecture. Operators stopped hosting lures on GitLab entirely and started using claude.ai's built-in share feature — creating publicly accessible URLs on a fully trusted, widely allowlisted domain. Google Ads then directed victims straight to weaponized claude.ai shared-chat pages. The AI interface itself appeared to give instructions. Developers, accustomed to asking AI tools for technical guidance, complied.
This is trust stacking. Google's ad infrastructure looks legitimate. GitLab looks legitimate. Claude.ai looks legitimate. Individually, each layer passes a casual inspection. The chain only reveals itself if you trace the full path — and most reputation-based defenses never do.
For a compromised developer machine, the blast radius is substantial. The researchers and consultants commenting on the campaign note that a typical developer endpoint holds browser session cookies, SSO tokens, SSH keys, Git credentials, cloud CLI tokens, and secrets in local config files. Attackers who land here may never need a password at all — authenticated sessions handle the lateral movement into CI/CD pipelines, container registries, and internal collaboration platforms.
This matters specifically for identity and access teams. Session token theft bypasses MFA entirely. An attacker presenting a valid, unexpired session token does not trigger an authentication challenge; the identity provider already considers that session established. Rate-limiting login attempts or enforcing phishing-resistant passkeys at the IdP would not have helped a victim who handed over the post-auth token.
Mitigations focus on behavior rather than reputation. Restricting local admin rights on developer endpoints, monitoring PowerShell and shell execution for anomalous invocations, and segmenting high-privilege engineering workflows from general browsing all reduce the attack surface. Blocking Google, GitLab, or Anthropic domains is not a realistic option for most organizations — which is precisely why this chain worked.
