Google Ads and AI-Powered Malware Spread via ClickFix: MacSync Malware Campaign Exposed
Cybercriminals Use Google Ads and AI Platform to Distribute MacSync Malware
Cybercriminals have devised a sophisticated scheme to distribute the MacSync data-stealing malware to Mac users, leveraging compromised Google Ads and fake guides on the Claude AI platform.
Attack Method
Researchers at Moonlock Lab, a cybersecurity unit of MacPaw, uncovered this new ClickFix attack, which begins with a manipulated Google search.
- The attackers hijacked legitimate Google Ads accounts belonging to reputable entities, including a Canadian children’s charity and a Colombian watch retailer.
- This allowed them to bypass Google’s security checks and display malicious ads to users searching for common technical terms.
- The ads directed users to one of two fake guides: a Claude AI Artifact titled “macOS Secure Command Execution” or a Medium article impersonating the official Apple Support Team.
Malware Installation
These guides instructed users to copy and paste a specific line of code into their Terminal, supposedly to fix a problem or install a tool.
However, this command secretly downloaded and installed the MacSync malware.
This infostealer targets the user’s Keychain, browser-saved logins, and private keys from cryptocurrency wallets, bundling the stolen data into a file named “osalogging.zip” and transmitting it to the attackers’ server.
Prevention
To avoid falling victim to this ClickFix attack, users should exercise caution when encountering guides or tutorials that instruct them to paste commands into their Terminal.
It is essential to fully understand the purpose and implications of any command before executing it.
This incident highlights the importance of vigilance and critical thinking in the face of increasingly sophisticated cyber threats.
About Author
English