{"id":236938,"date":"2026-05-12T02:30:45","date_gmt":"2026-05-12T07:30:45","guid":{"rendered":"https:\/\/lifeboat.com\/blog\/2026\/05\/hackers-abuse-google-ads-claude-ai-chats-to-push-mac-malware"},"modified":"2026-05-12T02:30:45","modified_gmt":"2026-05-12T07:30:45","slug":"hackers-abuse-google-ads-claude-ai-chats-to-push-mac-malware","status":"publish","type":"post","link":"https:\/\/lifeboat.com\/blog\/2026\/05\/hackers-abuse-google-ads-claude-ai-chats-to-push-mac-malware","title":{"rendered":"Hackers abuse Google ads, Claude.ai chats to push Mac malware"},"content":{"rendered":"<p><a class=\"aligncenter blog-photo\" href=\"https:\/\/lifeboat.com\/blog.images\/hackers-abuse-google-ads-claude-ai-chats-to-push-mac-malware.jpg\"><\/a><\/p>\n<p>Attackers are abusing Google Ads and legitimate <a href=\"http:\/\/Claude.ai\">Claude.ai<\/a> shared chats in an active malvertising campaign.<\/p>\n<p>Users searching for \u201cClaude mac download\u201d may come across sponsored search results that list <em><a href=\"http:\/\/claude.ai\">claude.ai<\/a> <\/em>as the target website, but lead to instructions that install malware on their Mac.<\/p>\n<p>The campaign was <a href=\"https:\/\/www.linkedin.com\/posts\/brkalbyrk7_macsync-ugcPost-7459229553027088384-7UXy\/\" target=\"_blank\" rel=\"nofollow noopener\">spotted by<\/a> Berk Albayrak, a security engineer at Trendyol Group, who shared his findings on LinkedIn.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for \u201cClaude mac download\u201d may come across sponsored search results that list claude.ai as the target website, but lead to instructions that install malware on their Mac. The campaign was spotted by Berk Albayrak, a security engineer at [\u2026]<\/p>\n","protected":false},"author":427,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[],"class_list":["post-236938","post","type-post","status-publish","format-standard","hentry","category-cybercrime-malcode"],"_links":{"self":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/users\/427"}],"replies":[{"embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/comments?post=236938"}],"version-history":[{"count":0,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/posts\/236938\/revisions"}],"wp:attachment":[{"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/media?parent=236938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/categories?post=236938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lifeboat.com\/blog\/wp-json\/wp\/v2\/tags?post=236938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}