Malvertising Campaign Targets macOS via Google Ads for Claude.ai Downloads — Detection and Mitigation

---
title: Potential macOS Gatekeeper Bypass via Xattr Removal
id: 8d1f9a23-4c2e-4f3a-9b5d-6e7f8a9b0c1d
status: experimental
description: Detects attempts to remove the 'com.apple.quarantine' extended attribute, often used by malware to bypass Gatekeeper execution controls.
references:
 - https://attack.mitre.org/techniques/T1553/001/
author: Security Arsenal
date: 2025/04/09
tags:
 - attack.defense_evasion
 - attack.t1553.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/xattr'
    CommandLine|contains:
      - '-d'
      - '-r'
      - '-cr'
    CommandLine|contains:
      - 'com.apple.quarantine'
falsepositives:
  - Legitimate users attempting to run unverified internal tools
level: high
---
title: Suspicious macOS Disk Image Download and Mount
id: 2e4f6b78-9a1d-4e5c-8f3b-1d2e3f4a5b6c
status: experimental
description: Detects the downloading of .dmg files followed by immediate mounting using hdiutil, a common pattern in malvertising campaigns.
references:
 - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.initial_access
  - attack.t1105
logsource:
  category: process_creation
  product: macos
detection:
  selector_download:
    Image|endswith:
      - '/curl'
      - '/wget'
    CommandLine|contains:
      - '.dmg'
  selector_mount:
    Image|endswith:
      - '/hdiutil'
    CommandLine|contains:
      - 'attach'
  condition: selector_download or selector_mount
falsepositives:
  - Legitimate software updates or downloads by admins
level: medium
---
title: Execution of Ad-Hoc Signed Application
id: 7c3d1e45-2b8f-4a9e-8c7d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of applications signed with an ad-hoc signature (no valid developer identity), which is common for unsigned malware payloads.
references:
 - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2025/04/09
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    CommandLine|contains:
      - 'codesign'
    CommandLine|contains:
      - '--display'
      - '-s'
      - '-' 
    CommandLine|contains:
      - 'ad hoc'
falsepositives:
  - Developers testing unsigned builds locally
level: low

// Hunt for suspicious xattr usage indicating Gatekeeper bypass
DeviceProcessEvents
| where Timestamp > ago(7d)
| where OSPlatform contains "macOS"
| where ProcessName has "xattr"
| where ProcessCommandLine has "-d" or ProcessCommandLine has "-r" 
| where ProcessCommandLine has "com.apple.quarantine"
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend FullPath = tostring(FolderPath) + "\" + tostring(ProcessName)

-- Hunt for recent .dmg files in user Downloads that may be malicious
SELECT FullPath, Size, Mtime, Mode
FROM glob(globs='/Users/*/Downloads/*.dmg')
WHERE Mtime > now() - 7d

-- Hunt for unsigned or ad-hoc signed apps executed recently
SELECT Name, Path, Signed, Hash.Path AS SHA256
FROM process_listing(pslist=pslist())
WHERE Signed =~ "ad hoc" OR Signed =~ "false"
  AND Path =~ "Downloads|/private/var/folders"

#!/bin/bash
# Script to identify and remediate potential Mac malware artifacts from the Claude.ai malvertising campaign
# Run with root privileges for best results

echo "[*] Checking for recently modified .dmg files in Downloads..."
find /Users/*/Downloads -name "*.dmg" -mtime -7 -ls 2>/dev/null

echo "[*] Checking for LaunchAgents in user profiles..."
# Look for recently created LaunchAgents (common persistence)
find /Users/*/Library/LaunchAgents -name "*.plist" -mtime -7 -exec ls -la {} \; 2>/dev/null

echo "[*] Checking for unsigned applications running..."
# Note: Killing processes requires caution. Investigate first.
# This section identifies suspicious processes for manual review
ps aux | grep -v grep | grep -i "downloads"

echo "[*] Remediation instructions:"
echo "1. Review the .dmg files listed above. If unknown, delete them."
echo "2. Investigate LaunchAgents. Verify the binary path in the 'ProgramArguments' key."
echo "3. If a malicious plist is found, remove the file and kill the associated process."