Home / Technology / Fake AI Installer Tricks Mac Users With Google Ads
Fake AI Installer Tricks Mac Users With Google Ads
17 Oct
Summary
- Scammers use Google ads and Bing redirects for fake AI downloads.
- Fake installers copy different commands than shown to users.
- Malicious ads leverage cloaking to hide dangerous content.
A deceptive scheme is targeting Mac users by exploiting search engine advertisements. Attackers are using Google ads, which then redirect through Bing, to lure individuals to fake download pages for popular AI assistants like Claude. These pages are designed to appear legitimate, mimicking the official software installation process.
The malicious installers employ a tactic known as "cloaking," where the content displayed differs based on the visitor's origin. This allows the scammers to hide their malicious operations from security reviews while deceiving users. A particularly insidious element involves the "Copy" button on these fake sites, which secretly places a dangerous command onto the user's clipboard instead of the displayed instruction.
This hidden command, often Base64 encoded, can execute malicious scripts on a user's Mac without their full knowledge. While the ultimate payload is not definitively identified, running such commands can potentially lead to data theft or system compromise. Google has since suspended the advertiser accounts involved, and Microsoft has confirmed its security protections detect these threats.
