Malicious Ads Target Homebrew Users with MacSync Stealer Malware

• •Malicious ads impersonating Homebrew lead to the installation of MacSync Stealer malware.
• •The fake Homebrew page is hosted on Google Sites, complicating detection efforts.
• •Users are advised to avoid running terminal commands from untrusted sources.

Cybercriminals are exploiting Google Ads to promote a fake Homebrew page that installs the MacSync infostealer malware, as reported by security researchers at the SANS Internet Storm Center. This campaign was first identified on April 30, 2026, and the malicious ads lead users to a site that mimics the legitimate Homebrew installation process. Users who execute the provided terminal command unknowingly install malware that collects sensitive information and sends it to a command and control server. The fake site is hosted on Google Sites, making it difficult for users to identify as malicious. The malware is designed to extract data from various applications, including Telegram and crypto wallets. Ongoing malvertising campaigns have been reported, with over 200 malicious ads impersonating popular macOS software identified earlier in 2026. Security experts recommend using ad blockers and avoiding running unknown terminal commands. The situation remains active, with researchers continuously monitoring the evolving threat landscape.