macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware

Cybersecuritynews •Abinaya • May 11, 2026

Threat actors are executing a sophisticated malvertising campaign targeting macOS users via poisoned Google Ads and deceptive artificial intelligence applications. Researchers recently uncovered an operation that redirects victims to fraudulent landing pages via results. By combining trusted hosting platforms with the notorious “Clickfix” social engineering tactic, attackers are successfully distributing MacSync payloads and […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages The InstallFix campaign targets users by creating fake installation pages for Anthropic's Claude AI, tricking them into executing malware. This sophisticated social engineering tactic exploits the growing reliance on AI tools, affecting both developers and non-technical users. The malware, primarily the Amatera Stealer, collects sensitive information and establishes persistence on compromised systems. Attackers use Google Ads to promote these malicious pages, which mimic legitimate installation commands. The campaign has been observed impacting users on both Windows and macOS platforms. Security researchers have identified the use of PowerShell and MSHTA to execute malicious commands. The threat landscape is evolving as attackers leverage common developer habits, increasing the risk of infection. Organizations are urged to remain vigilant against these deceptive tactics. 53 sources 70

Extracted Entities

macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware

The full story

Extracted Entities

Attack Types (1)

Domains (1)

Malware (1)

Platforms (2)