Malicious Google Ads Target Mac Users with Fake Mac Cleaner Pages

On 26 January 2026, MacKeeper researchers discovered malicious Google Ads for fake “Mac cleaner” tools that redirect victims to convincing Apple-style pages hosted on Google services (docs.google.com, business.google.com) and coerce users into executing Base64-obfuscated Terminal commands; those commands download and run a remote script that grants attackers full control of affected macOS systems, enabling file/SSH key theft, additional malware deployment, and abuse of system resources. The ads were served from Google-verified accounts that appear compromised, and MacKeeper has reported the activity to Google.