Fake “Mac Cleaner” Campaign Uses Google Ads to Redirect Users to Malware

Security researchers uncovered a campaign where threat actors exploit legitimate Google Search Ads (via compromised ad accounts) to send macOS users searching for disk-cleaning tools to Apple-branded Google Apps Script pages that host obfuscated remote code execution payloads; the malware uses Base64 and shell obfuscation to silently download and run remote scripts, enabling backdoors, data theft, and cryptomining.