Fake “Mac Cleaner” Ads Abuse Google Search to Deliver Malware to macOS Users

February 24, 2026•3 min read

Cybercriminals are once again abusing trusted platforms to distribute malware — this time by weaponizing Google Search Ads to target macOS users searching for routine system maintenance tools.

Security researchers have uncovered an active malvertising campaign where sponsored Google search results impersonate Apple-branded “Mac Cleaner” pages. These ads redirect victims to malicious Google Apps Script pages that execute remote code execution (RCE) payloads on macOS systems.

The campaign highlights a growing trend: attackers no longer need shady domains when they can hide inside trusted ones.

🚨 How the Campaign Works

When users search for terms like “mac cleaner” or “clean mac storage”, malicious sponsored ads appear at the top of Google Search results.

These ads:

Display trusted domains such as docs.google.com or business.google.com
Redirect users to Google Apps Script macro pages
Visually mimic Apple’s official website using cloned branding, navigation menus, and layout

Once on the page, users are instructed to run commands under the guise of:

Checking storage usage
Freeing disk space
Performing “routine macOS maintenance”

These familiar tasks lower suspicion — and that’s exactly the point.

⚙️ Technical Breakdown: Silent Remote Code Execution

🔹 Payload Variant One: Obfuscated Command Chains

The first malware variant uses Base64-encoded shell commands hidden behind reassuring status messages like:

“Cleaning macOS Storage…”
“Installing packages, please wait…”

Behind the scenes:

Base64 strings are decoded into executable shell commands
The commands are executed silently
Remote scripts are fetched and run without visible warnings

🔹 Payload Variant Two: Direct Bash Execution

The second variant is more aggressive:

Uses /bin/bash -c for direct execution
Employs command substitution $(…)
Decodes attacker-controlled URLs using echo | base64 -d
Downloads payloads via curl -fsSL and executes them immediately

Silent flags ensure no system prompts or feedback, leaving users unaware their system is compromised.

🎯 Impact: Full System Compromise

Once executed, the attacker gains full remote control of the macOS system.

Potential post-exploitation actions include:

Installing persistent backdoors
Stealing SSH keys and credentials
Exfiltrating sensitive files
Deploying cryptominers
Modifying system configurations

Because the malware runs quietly, users may not detect the compromise until long after damage is done.

🧩 Compromised Google Ads Accounts

Investigation suggests the malicious ads were not created from scratch.

Instead, attackers likely:

Compromised legitimate Google Ads accounts
Leveraged existing advertiser trust and verification
Mixed malicious ads alongside legitimate campaigns

This approach allows threat actors to bypass initial ad scrutiny and rapidly distribute malware at scale.

Researchers have reported the ads to Google, but the campaign demonstrates how advertising platforms remain high-value malware distribution channels.

🛡️ The Elliptic Systems Perspective

This campaign reinforces a critical security lesson:

“Sponsored” does not mean “safe.”

At Elliptic Systems, we consistently observe attackers exploiting: