Fake Homebrew Google ads target Mac users with malware

Malicious Google search ads impersonated the Homebrew site and redirected users to a fake installer hosted at brewe.sh; running the provided install command downloads AmosStealer (Atomic), an infostealer for macOS/Linux that steals credentials, browser data, desktop and extension cryptocurrency wallets. Security researchers linked a sample on VirusTotal and the ad was removed, but actors may reuse other redirect domains, so users should verify site URLs or bookmark official project pages before installing software.