Hackers Exploiting Arc Browser Popularity with Malicious Google Search Ads

### Executive Summary The article documents an active malvertising campaign that lures users to fake Arc browser installers which unpack a multi-stage malware chain (ArcBrowser.exe → bootstrap.exe → PNG-embedded payload → JRWeb.exe) using MEGA API and paste sites for C2, with multiple file hashes, domains, and a C2 IP provided as IOCs. The behavior and payloads are consistent with an information stealer delivered via social-engineered ads and sideloaded legitimate installers.