Malware Activity
When Trusted Platforms Become the Delivery Vehicle for Malware
Recent research highlights two (2) growing malware campaigns that show how attackers are exploiting trust and familiarity to bypass security controls. In one campaign, Mac users searching Google for a Claude AI download are lured by sponsored ads that appear legitimate and lead to shared Claude chat pages posing as official setup guides. These guides trick users into pasting Terminal commands that quietly install malware, which runs mostly in memory, changes its code frequently, and steals sensitive data like browser credentials and keychain information. In a separate but equally concerning campaign, a banking trojan called TCLBanker spreads through fake software installers that mimic trusted applications, such as a signed Logitech program. Thus, making the malware harder to detect. Once active, TCLBanker targets users in Brazil, displays convincing fake banking screens to steal login details, and can
