Hackers abuse Google ads, Claude.ai chats to push Mac malware
2026-05-11T01:23:30Z•53924fff603c030f27fca1b79c2baa7846841bdf0e8bfb8d0acb5ce237f39936
CISA directiveCanvas defacementClaude.aiGoogle AdsHugging FaceIvanti EPMMJDownloaderLinux Dirty FragNVIDIA GeForce NOWOpenAI impersonationOutlook propagation','trojanized-installer','PCPJack','Vidar StePython RATRansomHouseShinyHuntersTCLBankerTrellixWhatsApp propagationdata breachinfostealerlocal privilege escalationmac malwaremalvertisingsupply-chain compromisewormzero-day
What happened
Multiple active threats and breaches reported: attackers are abusing Google Ads and shared Claude.ai chats to distribute Mac malware; the JDownloader site was compromised to replace installers with malicious Windows and Linux installers (Windows payload: Python RAT); a malicious Hugging Face repo impersonating OpenAI pushed an infostealer to Windows users; NVIDIA confirmed a GeForce NOW user-data breach impacting Armenian users; Trellix source-code breach was claimed by RansomHouse; CISA ordered federal agencies to patch a high-severity Ivanti Endpoint Manager Mobile (EPMM) zero-day being used
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 53924fff603c030f27fca1b79c2baa7846841bdf0e8bfb8d0acb5ce237f39936
- Enrichment time
- 2026-05-11T01:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.