The Signal 10/14/26 - The top result was a billboard · The Signal · Radar

How the Redirect Campaign Worked0:57 – 3:06

0:57

Security researchers caught this one because a Google search ad showed up for people searching for the Mac version of a popular AI tool.

1:06

The ad looked unusually trustworthy because the destination it displayed was bing.com. A click went through Google's ad system, then through a legitimate Bing click tracking link, then to a hacked website belonging to a retailer on another continent.

1:23

and finally to a fake download page with a lookalike name.

1:28

Each hop had a purpose.

1:30

The Bing link made the ad pass inspection.

1:33

The hacked retailer site checked where you came from and only forwarded real searchers.

1:39

So an investigator typing the address directly saw a page not found.

1:45

the fake page then checked again that you arrived from a search engine this is a campaign built to be seen only by its targets then the trick that earns this episode a place in the catalog the fake page displayed the software maker's real install command character for character the same one on the official site But the copy button next to it put a different command on the clipboard, one that printed a fake downloading from the official source message while fetching and running a hidden file from a server the criminals controlled.

2:23

The final malware wasn't identified, but the shape is the familiar one from our Mac malware episodes, something that runs with your permission because you pasted it.

2:35

If you've been with us since July, you know the rule.

2:38

No web page ever gets a command pasted into your computer.

2:44

This campaign is the sharpest test of the rule yet because the page didn't ask you to paste something strange.

2:53

It showed you the real thing.

2:55

and swapped it on the way to your hands.

2:58

The rule holds anyway.

2:59

The command's origin is a web page reached through an ad.

3:03

That's disqualifying before you read a single character.

How the Redirect Campaign Worked0:57 – 3:06

0:57

Security researchers caught this one because a Google search ad showed up for people searching for the Mac version of a popular AI tool.

1:06

The ad looked unusually trustworthy because the destination it displayed was bing.com. A click went through Google's ad system, then through a legitimate Bing click tracking link, then to a hacked website belonging to a retailer on another continent.

1:23

and finally to a fake download page with a lookalike name.

1:28

Each hop had a purpose.

1:30

The Bing link made the ad pass inspection.

1:33

The hacked retailer site checked where you came from and only forwarded real searchers.

1:39

So an investigator typing the address directly saw a page not found.

1:45

the fake page then checked again that you arrived from a search engine this is a campaign built to be seen only by its targets then the trick that earns this episode a place in the catalog the fake page displayed the software maker's real install command character for character the same one on the official site But the copy button next to it put a different command on the clipboard, one that printed a fake downloading from the official source message while fetching and running a hidden file from a server the criminals controlled.

2:23

The final malware wasn't identified, but the shape is the familiar one from our Mac malware episodes, something that runs with your permission because you pasted it.

2:35

If you've been with us since July, you know the rule.

2:38

No web page ever gets a command pasted into your computer.

2:44

This campaign is the sharpest test of the rule yet because the page didn't ask you to paste something strange.

2:53

It showed you the real thing.

2:55

and swapped it on the way to your hands.

2:58

The rule holds anyway.

2:59

The command's origin is a web page reached through an ad.

3:03

That's disqualifying before you read a single character.