{"id":43700,"date":"2026-02-16T22:08:45","date_gmt":"2026-02-16T14:08:45","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/16\/google-ads-and-claude-ai-abused-to-spread-macsync-malware-via-clickfix\/"},"modified":"2026-02-16T22:08:45","modified_gmt":"2026-02-16T14:08:45","slug":"google-ads-and-claude-ai-abused-to-spread-macsync-malware-via-clickfix","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/02\/16\/google-ads-and-claude-ai-abused-to-spread-macsync-malware-via-clickfix\/","title":{"rendered":"Google Ads and Claude AI Abused to Spread MacSync Malware via ClickFix"},"content":{"rendered":"\n

Cyber security researchers at Moonlock Lab, the investigative unit of the popular software developer MacPaw, have uncovered a clever new way that hackers are targeting Mac users. This campaign uses the ClickFix<\/a> technique, where people are tricked into copying and pasting dangerous commands directly into their computer’s Terminal and the attack starts with a simple Google search.<\/p>\n

How the Trap is Set<\/strong><\/h3>\n

The hackers managed to hijack legitimate, verified Google Ads<\/a> accounts belonging to Earth Rangers, a Canadian children’s charity, and a Colombian watch retailer called T S Q SA. Because these accounts have an established history and a good reputation, their malicious adverts bypassed Google\u2019s security checks without any verification alarms.<\/p>\n

When users search for common technical terms like “online DNS resolver,” “HomeBrew,” or “macos cli disk space analyzer,” they are shown a “sponsored” link at the top of the results. As the team at Moonlock Lab recently shared in a series of posts on X (formerly Twitter): “What if a Google Sponsored result for a common macOS query led to malware? That’s happening right now.”<\/p>\n

\n
\n
\n

\ud83e\uddf5 1\/ \ud83d\udea8 What if a Google Sponsored result for a common macOS query led to malware? That's happening right now and 15K+ people have already seen it.
We at @MoonlockLab observed 2 variants today abusing legitimate platforms for ClickFix delivery: a @AnthropicAI<\/a> public artifact on\u2026 pic.twitter.com\/e1ocnQPmV4<\/a><\/p>\n

— Moonlock Lab (@moonlock_lab) February 11, 2026<\/a><\/p><\/blockquote>\n