Originally reported by Hackread
TL;DR
Threat actors exploit hijacked Google Ads and fake Claude AI tutorials to distribute MacSync data-stealing malware targeting Mac users through ClickFix attack vectors.
Active malware distribution campaign using hijacked Google Ads and ClickFix social engineering to deploy MacSync data-stealer on macOS. New malware family with active distribution but limited to Mac users.
Moonlock Lab security researchers have uncovered a sophisticated malware distribution campaign targeting macOS users through a combination of hijacked advertising infrastructure and AI brand impersonation. The attack leverages ClickFix social engineering techniques to deploy MacSync, a data-stealing trojan designed specifically for Apple's desktop operating system.
The campaign demonstrates an evolution in threat actor tactics, combining legitimate advertising platforms with the growing trust users place in AI assistants to create a highly effective infection vector.
The threat actors employ a multi-stage approach:
The ClickFix method exploits user trust in technical support content, presenting malicious commands as solutions to fabricated system issues. This technique bypasses traditional security awareness training focused on suspicious downloads or email attachments.
According to the Moonlock Lab analysis, MacSync exhibits standard information-stealing functionality:
The malware specifically targets macOS environments, indicating threat actors are expanding focus beyond traditional Windows-centric campaigns.
The researchers have not provided attribution details for the campaign operators. The use of hijacked Google Ads infrastructure suggests either compromised advertiser accounts or exploitation of the advertising platform's approval processes.
The impersonation of Claude AI, Anthropic's conversational AI system, represents a concerning trend of threat actors leveraging AI brand recognition for malicious purposes.
Originally reported by Hackread
