Fake “Mac Cleaner” Campaign Uses Google Ads to Redirect Users to Malware

Why It Matters

The abuse of trusted advertising platforms undermines user confidence and exposes enterprises to supply‑chain‑style malware infections, forcing IT teams to tighten ad‑click policies and monitor endpoint security.

Key Takeaways

• Google Ads used to deliver macOS malware.
• Malicious landing pages mimic Apple’s website design.
• Scripts execute hidden Base64 commands for remote code execution.
• Compromised legitimate ad accounts bypass verification checks.
• Users risk ransomware, crypto miners, data theft.

Pulse Analysis

Ad networks have become a lucrative vector for threat actors seeking to bypass traditional security perimeters. By hijacking legitimate Google Ads accounts, criminals exploit the platform’s inherent trust, placing malicious links alongside genuine sponsored results. This tactic not only sidesteps Google’s initial verification but also leverages the massive reach of search advertising, turning everyday queries for system‑maintenance tools into infection pathways. The incident underscores a growing trend where credential theft fuels ad‑fraud campaigns, blurring the line between legitimate marketing and cyber‑espionage.

The technical backbone of the campaign relies on Google Apps Script pages that masquerade as Apple’s support site. Once a user clicks the ad, the script delivers a Base64‑encoded payload that is decoded and piped into a silent Bash command, executing remote code without prompting the user. Variants include direct shell execution and curl‑based retrieval of additional scripts from attacker‑controlled servers. By targeting macOS users searching for “mac cleaner,” the attackers capitalize on a niche demand for maintenance utilities, increasing the likelihood of execution. The payloads are capable of installing secondary malware, harvesting SSH keys, and deploying cryptocurrency miners, all while remaining invisible to the average user.

Mitigation requires a multi‑layered approach. Organizations should educate employees to verify the authenticity of system‑maintenance tools and avoid clicking sponsored results for such utilities. Endpoint protection solutions need to monitor for suspicious script execution patterns, especially Base64 decoding and silent curl commands. Meanwhile, ad platforms must strengthen account security, enforce stricter vetting of ad content, and accelerate removal of malicious campaigns. As threat actors continue to weaponize trusted channels, proactive detection and robust user awareness remain essential to safeguarding corporate macOS fleets.