Thursday, May 1, 2025
Homecyber securityHackers Using Google Ads To Deliver 'Poseidon' Mac Stealer

Hackers Using Google Ads To Deliver ‘Poseidon’ Mac Stealer

Published on

SIEM as a Service

Follow Us on Google News

Hackers abuse Mac Stealer to covertly extract sensitive information such as passwords, financial data, and personal files from macOS devices.

Besides this, macOS users or Mac users are considered valuer targets.

On June 24th, Malwarebytes researchers identified another Mac-specific stealer campaign named Poseidon. This campaign used Google malicious ads for the Arc browser.

- Advertisement - Google News

This is the second instance of Arc being used as a lure by OSX in recent times. RodStealer is distributing malware.

Created by Rodrigo4, a threat actor who competed with Atomic Stealer, this tool is more developed and can steal VPN configurations.

Hackers Using Google Ads

The ad for this malware was found on the XSS underground forum and it offers similar functionalities to Atomic Stealer such as file grabbing, extraction of crypto wallets, and theft of password managers.

"Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!"- Free Demo

What this campaign shows is that attackers responsible for Mac-related malware have started using new strategies while always exploiting popular software.

A Google ad campaign for the Arc browser that maliciously redirects people to a fraudulent site (arc-download[.]com) that offers a Mac-only version is connected to “Coles & Co” and arcthost[.]org.

Malicious ad for Arc browser via Google search (Source – Malwarebytes)

The downloaded DMG file uses a right-click bypass for security to make it seem like a genuine Mac application installation process.

This recent malware called “Poseidon,” which builds on previous ones, has incomplete code for stealing VPN configurations from Fortinet and OpenVPN.

Malware exfiltrates data to a specific IP address leading to a Poseidon-branded control panel, implying a sophisticated and evolving risk to MacOS users.

An active Mac malware development scene focuses on stealers like Poseidon. Threat actors advertise feature-rich products with low antivirus detection to potential customers. 

The observed campaign confirms the active targeting of new victims. Protection requires vigilance when installing new apps. 

Malwarebytes continues detecting this threat as OSX.RodStealer and has informed Google about the malicious ad. 

Users are advised to employ web protection tools like Malwarebytes Browser Guard to block ads and malicious websites as a primary defense against such evolving Mac-targeted threats.

IoCs

IoCs (Source – Malwarebytes)

Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Quantum Computing and Cybersecurity – What CISOs Need to Know Now

As quantum computing transitions from theoretical research to practical application, Chief Information Security Officers...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Netgear EX6200 Flaw Enables Remote Access and Data Theft

Security researchers have disclosed three critical vulnerabilities in the Netgear EX6200 Wi-Fi range extender...

Tesla Model 3 VCSEC Vulnerability Lets Hackers Run Arbitrary Code

A high security flaw in Tesla’s Model 3 vehicles, disclosed at the 2025 Pwn2Own...

Apache ActiveMQ Vulnerability Lets Remote Hackers Execute Arbitrary Code

A high vulnerability in Apache ActiveMQ’s .NET Message Service (NMS) library has been uncovered,...