Netcrook
#malvertising
Search Ads, Fake Installers, and the Mac Trust Trap
A malvertising campaign is using Google Ads and a fake Claude Code installer to reach macOS users, showing how cybercrime now leans on trust instead of obvious exploits.
Fake AI Installers Are the New Phishing Kit for Developer Macs
A malvertising campaign dressed up as a Claude Code setup guide shows how one pasted command can turn a developer workstation into a map of reusable secrets.
SourTrade Moves the Finish Line Into the Browser
A malvertising campaign is reportedly using browser-side assembly to build its payload in memory, a tactic that weakens file-based detection and complicates incident response.
Fake Crypto Pages, Real Risk: How Browser JavaScript Can Assemble Malware in Memory
A malvertising run dressed up as Solana, Luno, and TradingView shows how a browser can be turned into part of the delivery chain, not just the place where victims land.
When the Browser Becomes the Payload Factory
A malvertising chain tied to trading and crypto lures shows how ServiceWorkers and SharedWorkers can be repurposed for runtime assembly inside the browser, complicating file-based defense.
When the Browser Becomes the Factory Line for Malware
SourTrade turns ordinary web delivery into a per-victim build process, a design that weakens hash-based detection and blurs the line between browsing and infection.
The Search Result That Opened the Door to a RAT
A malvertising chain that mimicked Claude Desktop and ran through Bing Ads shows how a trusted software search can become a post-exploitation problem almost instantly.
Claude-Brand Lures Turn a Search Habit Into a Remote-Control Trap
A Claude Desktop-themed download flow is being used to deliver SectopRAT, showing how ad-driven redirection and fake installers can turn brand trust into a credential and file theft problem.
Paid Search, Shared AI Links, and a Mac Stealer: The New Trust Trap
A macOS malware campaign used Google Ads and Claude shared-chat links as delivery channels, showing how attackers can turn familiar services into a credential-harvesting lure.
Fake AI Installers Are Becoming a macOS Trapdoor for Credential Theft
A reported MacSync Stealer campaign shows how sponsored search, brand impersonation, and terminal-based trust can turn a routine software install into a path to stolen secrets.
Sponsored Search, Silent Loader: How a Fake Ad Chain Turns Into Credential Theft
A newly described malware loader, OXLOADER, shows how a simple ad click can become a staged delivery path for CastleStealer and other credential-grabbing payloads.
Search Ads, Hidden Code, and a Loader Built to Dodge the First Look
OXLOADER shows how a malicious click path can be paired with compiler-style obfuscation to make a Windows infection chain harder to inspect before it runs.
Fake Node.js Ads Turn Search Traffic Into a Malware Runway
A sponsored-search lure impersonating Node.js shows how routine software downloads can be redirected into a Windows loader and infostealer chain.
Shortcut Trap, Script Chain: The Quiet Route From a Fake Tool Search to an In-Memory RAT
A Windows shortcut, a PowerShell downloader, and a ClickFix-style lure can turn a routine search for AI tools into a stealthy intrusion path.
Shared AI Chats, Ad Tech, and a Click to Chaos: The New Social Engineering Blend
A reported malvertising campaign shows how a trusted AI share link can be turned into a lure, with the real danger arriving when users are pushed to run commands themselves.
Fake AI Logins Are the New Front Door for Credential Thieves
Attackers are leaning on the trust attached to familiar AI brands, steering users from search results and ads into counterfeit sign-in pages built to collect credentials.
Mac Users Are Being Lured Into a Browser-Driven Backdoor Trap
A malvertising campaign on macOS shows how ad inventory, WebView logic, and remote content can be chained into a stealthy backdoor pipeline.
Mac Users Tapped by a Malvertising Pathway Built for More Than Annoyance
A campaign tied to the FlutterShell backdoor shows how ad delivery, browser trust, and macOS protections can be chained into a threat path that is harder to spot than a typical adware infection.
Mac Ads as an Entry Point: FlutterShell Shows How a Click Can Become a Trust Problem
Malicious advertising is being used to push a macOS backdoor, and the case highlights how social engineering can be more effective than a direct exploit.
When the Ad Slot Becomes the Trap: Fake ChatGPT Downloads Weaponize Search Trust
A lookalike download page and sponsored listings show how cybercriminals can turn search visibility into a malware delivery path.