Fake Mac Cleaner Ads: How to Spot the Trap

Search for “mac cleaner” or “clear cache mac” in 2026 and the top of the page may not be a result at all. Sponsored placements sit above the organic list, and several documented campaigns have used them to put Mac users one click from an infostealer. The ads look ordinary. The pages behind them imitate Apple support articles or the download page of the tool you were actually looking for. This post is about telling the difference, which is usually possible once you know which part of the screen to trust.

How the scam actually works

The chain starts with a paid search ad. BleepingComputer reported fake Homebrew ads on Google that showed the real project’s address in the ad while sending clicks to a lookalike domain, and that is the entire trick in one step: the URL displayed in an ad is text the advertiser supplies, not a promise about where you land. Malwarebytes traced a set of Google ads that funneled Mac users into poisoned AI chat pages, staged conversations built to deliver an install step that ended in the AMOS infostealer.

The landing page is where the effort goes. Some are careful copies of a vendor’s download page; others borrow the layout of an Apple support article, which lends their instructions authority they never earned. Researchers have also found lures staged on legitimate hosting and document-sharing services, so the domain in the address bar is one you recognize and the usual sketchy-URL instinct never fires.

From there the page has two endings. It either offers a trojanized installer that looks like the app you wanted, or it never gives you an app at all. Microsoft documented a ClickFix campaign that used fake macOS utility lures to deliver infostealers, and the ClickFix move is instructional rather than technical: the page tells you to copy a line of text and paste it into Terminal to complete the installation or repair whatever it claims to have found. That command fetches and runs the payload, and because you ran it yourself, none of the checks macOS applies to downloaded apps get a turn.

Both the Homebrew ads and the ClickFix lures ended in the same family of malware, AMOS, also known as Atomic Stealer. It goes after the contents worth stealing: passwords saved in browsers, cryptocurrency wallets, and Keychain data. A cleanup utility is a convenient disguise for that because people expect a cleaner to ask for broad access to the disk.

The tells

The ad’s display URL is the first one, and it costs nothing to check. Read the domain of the page you actually landed on rather than the address the ad showed you, and confirm it matches the vendor you meant to visit. Our guide to reading a link before you click it covers the right-to-left habit that makes lookalike domains obvious.

The second is manufactured urgency. A page that scans your Mac the moment it loads and announces infections, junk files, or a failing disk is performing, not measuring. A web page cannot inspect your drive, so every number in that report was written before you arrived.

The third is the one to treat as absolute: any site that asks you to paste a command into Terminal to fix, unlock, verify, or install something. There is no legitimate version of that request arriving from a search ad. Close the tab, and if you already copied the command, copy something harmless over it.

Two smaller signals round it out. A download hosted somewhere other than the vendor’s own domain deserves suspicion, since a real developer distributes from their site or the App Store rather than a file locker or a document link. And a “cleaner” you have no memory of installing, now showing warnings and asking for money, is not a tool that got confused. It is the problem describing itself as the solution.

How to get tools safely

Skip sponsored results entirely when you are downloading software. The habit is crude and it works, because it removes the one surface these campaigns rely on. Type the vendor’s address directly, use a bookmark you saved when you knew the site was right, or install from the Mac App Store where Apple reviews the listing.

When you do download from the open web, check the developer name on the app before you open it, and let macOS do its part. Gatekeeper verifies that an app is signed by a known developer and notarized by Apple on first launch, so a warning that an app can’t be verified is information, not an obstacle to click past. Our honest look at whether Macs need antivirus explains what those layers cover and where they stop.

If you already ran one

Start by disconnecting the Mac from the network, which cuts off anything still sending data out. Then move to a device you trust and change passwords from there, not from the machine in question. Email first, since it is the reset path for everything else, then banking, then any account holding money or crypto. Turn on two-factor authentication anywhere it was off.

Check Keychain Access for entries you don’t recognize, and assume anything stored in the browser was read. Run a full security scan on the Mac to find what was installed alongside the thing you ran, since these installers rarely arrive alone.

One more rule, and it is the easiest to follow: do not pay the fake tool anything. If a cleaner demands a fee to remove the problems it found, that payment buys nothing, and it hands your card details to the same people who staged the scan.