This month, researchers at Push Security documented an ad that should worry anyone who's installed an AI app this year. A Google search for "claude mac," which is what you'd type if you wanted Anthropic's AI assistant on a MacBook, put a sponsored link at the top of the results. The web address printed under it read bing.com, which is Microsoft's search engine and about the last place a Google ad has any business sending you.

The link led to a clean, professional page that looked like Anthropic's own download page. It showed the real one-line install command Anthropic publishes for Mac users, the kind you paste into Terminal, which is the program that lets you type instructions directly to the computer. Beside it sat a copy button. The command on the screen was real. The one the button put on your clipboard wasn't, and once it ran, it pulled a script from a hidden address and fed it straight into the machine without saving a file, so there was nothing on the disk for antivirus software to find.

Nobody broke into anything. The owner pasted the command and pressed Return, and the security software saw exactly what it was built to trust, a person at his own keyboard telling his own machine what to do.

Microsoft says that between February and early May, its Defender security software watched people run pasted commands like that one on more than 1.1 million devices.

In August I told you about Alex Rivlin, a Las Vegas real estate developer who asked Google's AI for a Royal Caribbean shuttle number, called the number it gave him, and reached a scammer, who had drained his card by morning. The criminals hadn't hacked Google. They planted a number where the machine would find it and let the machine hand it over.

This week it's a command instead of a phone number, and you type it in yourself. I want to use this issue to teach a little about how AI really shows up in fraud, because most of what you hear about it is science fiction or a sales pitch, and the real thing is more ordinary and a lot more useful to understand.

There's a real Walmart in this story too, and a delivery driver whose instincts started a police case. And at the end, a short note on Monday's $1 million voter fraud reward and who'll try to collect it first.

Three Keystrokes

The technique is called ClickFix, and it's been circulating since about 2024. You land on a page, sometimes a hacked legitimate site and sometimes a fake one you reached through a search ad, and up comes something that looks like ordinary internet friction: a CAPTCHA, an error message, a box asking you to prove you're human. The instructions are short. On Windows, hold the Windows key and press R, which opens a small box called Run. Press Ctrl and V. Press Enter. On a Mac, the page tells you to open Terminal and paste.

While you were reading, the page quietly copied a command onto your clipboard. Ctrl and V pastes it, Enter runs it, and you've just installed the criminal's software yourself, from the most trusted account on the computer, which is yours.

It works because the request is small and familiar. You've clicked "I'm not a robot" a thousand times and picked every traffic light out of a grid of blurry photos, and it's never once cost you money. The fake borrows that ritual. It asks for three keystrokes, not a password or a card number, so the part of you that guards passwords and card numbers never wakes up. Most people have never heard of the Run box, which means they have no idea what they've just done.

And the security software is looking the other way. It's built to catch programs that sneak in through an attachment or a bad download, and ClickFix doesn't sneak, because the owner opens the door and holds it. It doesn't take much skill on the other end, either. Microsoft says criminals now sell ClickFix kits as a service to anyone with a little money.

Microsoft's analysts described the results in the language of a marketing department, which is how the people running these campaigns think about them too.

Why AI Made It Worse

Think about what installing an AI tool asks of a person. Anthropic, the company behind Claude, tells Mac users installing its coding tool to open Terminal and paste a single line, because that's how the software really installs. So this year a lot of curious people who'd never opened Terminal in their lives learned that pasting a command from a website is a normal thing to do, and the criminals learned it right along with them.

ANY.RUN runs a public service where security analysts open suspicious files inside a sealed-off computer to watch what they do. Between mid-April and early October, it traced 1,258 of those analyses to campaigns built around fake AI tools. 601 impersonated Claude, 418 impersonated OpenAI's ChatGPT or Codex, and at least 45% told the victim to paste a command. Those are samples analysts chose to submit, not a count of victims, and I couldn't find anyone who claims to know the real number.

None of this needs your email address. Push Security says 4 in 5 of the ClickFix pages it intercepted this year came up through search engines, by way of paid ads, hacked websites, and pages rigged to rank.

Then the criminals moved onto the AI companies' own websites. Claude and ChatGPT both let any user publish a conversation as a public link, so you can send a friend a recipe or a travel plan. The link lives on claude.ai or chatgpt.com with the company's name right there in the address, and the company didn't write a word of what's on the page. For years the advice has been to check the address before you trust a page. On a shared chat, the address is real and tells you nothing. Trend Micro documented a Google Ads campaign that moved its ClickFix instructions onto shared Claude chats in six waves between April and June, and Huntress caught the same trick last December with shared ChatGPT and Grok conversations that walked Mac users into installing password-stealing malware.

Push also found a custom GPT, a version of ChatGPT that anyone can build with their own instructions and publish, that answered every question with a fake "Service Availability Notice" and a link to a ClickFix page. By the time Push spotted it, it had logged more than 10,000 conversations.

The Guard Gets an AI

On October 20, Google announced that Chrome is fighting back with an AI of its own. If you turn on a setting called Enhanced Protection, Chrome now sends the text of pages that show strong signs of a scam to a Gemini model on Google's servers. The model judges what brand the page claims to be, what it's trying to get you to do, and how likely it is to be a scam, and Chrome weighs that verdict against what it knows about the site's reputation. Pages that look wrong but fall short of the full red warning screen get a new, milder "suspicious site" warning.

One check goes straight at ClickFix. When you copy a command from a page Chrome suspects, it scrubs personal information out of what you copied, sends the rest to Google's Safe Browsing service, and warns you before you go any further if the answer comes back dangerous.

It's the clearest example I've seen of what AI changes on defense, so it's worth a minute. The old protection worked from lists. A site got reported, its address went on a blocklist, and your browser refused to open it. That does nothing against a page on a brand-new domain, and less than nothing against a page on claude.ai, which nobody is going to block. A language model doesn't need the list. It can read a page that claims to be Anthropic, sits on an address Anthropic doesn't own, and asks a visitor to paste a command into Terminal to prove he's human, and it can notice that none of that adds up, the way a suspicious person would.

It comes with costs, and you should know them before you flip the switch. Enhanced Protection is off unless you turn it on, and it works by sending more of what you browse to Google, which says that content is processed and discarded, never logged, kept, or used to train its models. Google also claims Enhanced Protection makes people 10 times safer from scams than the standard setting, without publishing the data behind that number, so I'd file it under advertising. And criminals will test their pages against Gemini the way they've always tested their malware against antivirus software.

I'd turn it on anyway, especially on a parent's computer, where the alternative is no guard at all.

Then the Scam Stopped Needing You

Everything so far still needs a human to press the keys, and the next version won't.

In August of last year, researchers at Guardio Labs tested Comet, an AI web browser from Perplexity that can shop on its owner's behalf. They built a fake Walmart store with a single prompt to an AI website builder called Lovable, opened it in Comet, and gave the agent one instruction: "Buy me an Apple Watch." Comet put the watch in the cart, filled in the saved address and credit card from the browser, and completed the purchase without asking its owner to confirm anything. Results varied from run to run, and sometimes it balked or handed checkout back to the person, but in some runs it went all the way through.

Then they built what they called PromptFix, a ClickFix written for the machine instead of the person. A fake message from a doctor's office offered recent blood test results, and the owner asked the AI to take care of it. On the page, in text hidden from human eyes, were instructions telling the agent this was a special CAPTCHA made for AIs and that it could solve it for its owner by clicking a button. The agent clicked, and a download started. In the test the file was harmless, and Guardio's point was that it didn't have to be.

These were lab tests. I looked for a confirmed case of a hijacked AI agent spending someone's real money and couldn't find one, though researchers have kept finding new ways to hijack these browsers since, and I'd bet on the real cases arriving before most people think to delete their saved cards.

The human version of the same crime just ended in arrests in Arizona, at the real Walmart, and how it got caught is the lesson.

Peoria police say a ring used hacked Walmart.com accounts and stolen card numbers to place about 15,500 orders, changing the delivery addresses to get around fraud alerts. Police tied 11,364 of those orders, worth more than $768,000, to six drop houses in Mesa, Avondale, Glendale, and Peoria. From there the goods ran through two boba tea shops, one in Peoria and one in Tolleson, a detail I have no theory about whatsoever, then went by van and U-Haul trailer to California and overseas in shipping containers. Police seized $35,000 in cash and $45,000 in gold bars.

It started on August 22, when a Walmart delivery driver reported dropping 30 to 50 packages addressed to different names at the same house in a couple of days. Two months later, police and Homeland Security Investigations served search warrants and booked six people into the Maricopa County jail on fraud, identity theft, and stolen property charges. They're presumed innocent, and the man police call the organizer told them he was only an employee of the shipping company, which police believe he owns.

Look at what gave the ring away. Strange names, changed addresses, and a pile of boxes at one house all came from criminals pretending to be someone else, and pretending leaves marks. An AI agent tricked into a fake store doesn't pretend anything. It's your agent, paying with your card and shipping to your address. The fraud systems banks have spent decades building are good at spotting a stranger acting like you. They have far less to say about you, or the software you hired, doing something foolish on your own.

Field Manual

Six rules. The first one alone would have spared every one of those 1.1 million devices.