Fake “Mac Cleaner” Campaign Uses Google Ads to Redirect Users to Malware

Overview of Malware Distribution via Google Search Ads

Cybercriminals are leveraging Google Search Ads to distribute malware by creating deceptive landing pages that mimic Apple's official website design. These ads appear prominently in Google Search results for queries like "mac cleaner," using trusted domains such as docs.google.com and business.google.com as landing pages. Clicking these ads redirects users to Google Apps Script pages that are disguised with Apple's branding, including replica navigation menus and interface elements.

The malware uses sophisticated obfuscation techniques to mask its true purpose. The first variant employs a series of commands that start with social engineering messages such as "Cleaning macOS Storage," followed by hidden Base64-encoded commands. These are decoded to executable shell commands using base64 -D. Additional deceptive messages like "Installing packages please wait..." give the impression of legitimate system maintenance while executing the malware remotely.

The second payload variant uses a more direct approach, employing /bin/bash -c to execute commands. This includes command substitution $() for hidden instructions and echo | base64 -d to decode URLs, which the curl -fsSL command then retrieves from attacker-controlled servers. This method bypasses user visibility and executes remote scripts silently.

Both payloads represent remote code execution (RCE) vulnerabilities, granting attackers full control over infected systems. Once executed, the scripts can install malware, steal SSH keys, add persistent backdoors, deploy cryptocurrency miners, exfiltrate sensitive files, or modify critical system settings without user awareness due to silent execution flags.

Investigations indicate that the Google Ads accounts behind this campaign may have been compromised. Ads from entities such as Aloha Shirt Shop show a mix of legitimate and suspicious content, suggesting credential compromise rather than deliberate malicious intent by the account owners. Reports of these malicious ads have been submitted to Google for removal and further investigation.

This situation highlights how attackers exploit legitimate advertising platforms as distribution channels, using social engineering combined with technical obfuscation to compromise macOS systems on a large scale. It is likely that attackers gained access to legitimate Google Ads accounts through credential theft or account takeover. Using established accounts allows threat actors to bypass initial verification checks and distribute malware effectively through trusted channels.

Users are advised to exercise caution when clicking sponsored search results, especially for system maintenance utilities. Verification through official Apple channels is crucial before executing any cleanup instructions. For legitimate macOS maintenance, users should refer to Apple's official support documentation or use reputable system utilities from verified sources.

Based on reporting by GBHackers.