Threat Actors Leverage Google Search Ads for ‘Mac Cleaner’ to Direct Users to Malicious Websites

Cybercriminals are running a malvertising campaign that places sponsored Google Search Ads for terms like “mac cleaner,” redirecting macOS users to Apple-lookalike pages that supply base64‑encoded Terminal commands; when copied and executed by victims, these commands decode, download and run malicious scripts granting attackers full system control to install malware, steal SSH keys and files, deploy backdoors or mine cryptocurrency. MacKeeper researchers traced the operation to hijacked Google Ads accounts and reported the ads to Google, which removed them from search results.