2026-05-11 (MONDAY): GOOGLE AD FOR CLAUDE LEADS TO MACOS MALWARE INFECTION

NOTICE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILES:

• 2026-05-11-IOCs-for-macOS-malware-infection.txt.zip   1.9 kB   (1,884 bytes)
• 2026-05-11-macOS-malware-infection-traffic.pcap.zip   17.8 MB   (17,805,524 bytes)
• 2026-05-11-files-from-macOS-malware-infection.zip   1.3 MB   (2,328,112 bytes)

IMAGES

Shown above: Google ad in results from a search for Homebrew.

Shown above: Advertiser from the malicious ad.

Shown above: Oage impersonating a site to download Claude.

Shown above: ClickFix-style instructions from malicious page impersonating site to download Claude.

Shown above: Command copied from the page and pasted into a terminal window.

Shown above: During the infection, the malware asks for the user's password.

Shown above: The malware also asks for access to Finder.

Shown above: The malware also asks for access to various folders from the user.

Shown above: Traffic from the infection filtered in Wireshark.

Click here to return to the main page.