Google Ads Weaponized to Distribute macOS Malware via Fake Brew.sh Site

The perceived security of the macOS ecosystem is under direct assault by a cunning new malvertising campaign that weaponizes Google's own advertising platform. Security researchers have uncovered an operation where threat actors purchase Google Ads targeting users searching for the legitimate Homebrew package manager website, brew.sh. This attack marks a concerning shift in tactics, moving beyond phishing emails to compromise users at the very moment they seek out trusted software.

The attack chain is deceptively simple yet highly effective. When a user searches for 'brew.sh' or related terms, a malicious ad, often appearing as the first result, directs them not to the genuine site but to a typosquatted domain: brewe.sh. This single-character difference is easy to overlook, especially when the link is presented within a trusted Google Ads interface. The fraudulent site is a near-perfect replica of the official Homebrew page, meticulously crafted to avoid raising suspicion.

Here, the attackers deploy a social engineering technique known as 'ClickFix.' Before showing any supposed download, the site presents users with a CAPTCHA challenge. This step serves a dual psychological purpose: it lends an air of legitimacy (implying security measures are in place) and creates a sense of investment. Once the user solves the CAPTCHA, the site rewards them not with a standard installer, but with a block of text meant to be copied and pasted directly into the macOS Terminal.

The provided command is the payload. It is a bash script that, when executed, downloads and runs a malicious binary from a remote server under the attackers' control. This binary is identified as a new information-stealing malware family named 'Infiniti Stealer.'

Technical Analysis of Infiniti Stealer
Once installed, Infiniti Stealer operates with a broad data-harvesting mandate. Its capabilities are tailored to extract maximum value from an infected Mac:

• Credential Theft: It targets browsers like Chrome, Safari, Firefox, and Edge, scraping saved login credentials, cookies, and autofill data.
• Cryptocurrency Targeting: The malware actively searches for and exfiltrates cryptocurrency wallet files and related seed phrases, a clear indicator of financial motivation.
• System Espionage: It collects detailed system information, including hardware specs, installed applications, and active processes, which can be used for further targeting or sold on cybercriminal forums.
• File Exfiltration: It can be configured to seek out and steal specific document types from the user's directories.

The use of Google Ads as the initial vector is particularly insidious. It bypasses traditional network-based defenses and exploits the inherent trust users place in search engine results. The campaign highlights a critical vulnerability in the digital ad supply chain, where verification processes can be gamed by determined adversaries.

Implications for the Cybersecurity Community
This campaign is a wake-up call for several reasons. First, it signifies the continued maturation of macOS-focused malware economics. The development and deployment of a dedicated stealer like Infiniti Stealer indicate a profitable target market. Second, it demonstrates a professionalization of attack methods, combining precise ad buys, convincing clone sites, and advanced social engineering (ClickFix) into a seamless infection pipeline.

For enterprise security teams, especially those in mixed-OS environments or with BYOD policies, this underscores the need to extend threat-hunting and user awareness training to macOS endpoints. The assumption that Macs are immune to widespread malware campaigns is dangerously outdated.

Recommendations for Mitigation

1. User Education: Train users to be skeptical of ads, even on Google. Encourage them to look for the small 'Ad' label and to manually type known URLs or use bookmarks for critical tools.
2. Ad-Blocking & Security Tools: Consider the use of reputable ad-blockers and DNS filtering services that can block known malicious domains like 'brewe.sh'.
3. Endpoint Protection: Ensure all macOS devices are protected by advanced endpoint detection and response (EDR) solutions capable of identifying and blocking the execution of suspicious scripts and unknown binaries.
4. Vigilance with Terminal: Instill a security principle: never copy and execute a Terminal command from an untrusted website without understanding its function.

The fusion of malvertising, typosquatting, and social engineering in this campaign represents a potent threat vector. As long as digital advertising remains a viable infection channel, both individual users and organizations must adjust their defensive postures, recognizing that threats can originate from the most seemingly legitimate corners of the internet.