Cybersecurity articles tagged #Malvertising on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/vidar-stealer-xmrig-campaign-leverages-malvertising-amsi-bypasshttps://runtimerebel.com/blog/vidar-stealer-xmrig-campaign-leverages-malvertising-amsi-bypassFinancially motivated campaign delivers Vidar stealer and XMRig miner via malvertising for cracked software, targeting consumers and SMBs globally.Sun, 09 Aug 2026 01:01:35 GMTVidar StealerXMRigMalvertisingCredential TheftFactory V3https://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-thefthttps://runtimerebel.com/blog/dprk-linked-macos-malvertising-uses-fake-updates-for-crypto-theftNorth Korean threat actors are using deceptive full-screen macOS update pages to distribute crypto-stealing malware in a new Contagious Interview campaign.Thu, 30 Jul 2026 21:11:51 GMTmacOSLazarus GroupMalvertisingCryptocurrencyDPRKhttps://runtimerebel.com/blog/sourtrade-malvertising-evasion-via-browser-side-bun-runtime-assemblyhttps://runtimerebel.com/blog/sourtrade-malvertising-evasion-via-browser-side-bun-runtime-assemblyThe SourTrade malvertising operation bypasses security controls by using the victim's browser to assemble malicious Bun runtime executables in real-time.Sat, 25 Jul 2026 20:54:14 GMTSourTradeMalvertisingBun RuntimeCryptocurrency TradingEvasion Techniqueshttps://runtimerebel.com/blog/bing-ads-promote-fake-claude-app-deliver-sectoprat-malwarehttps://runtimerebel.com/blog/bing-ads-promote-fake-claude-app-deliver-sectoprat-malwareA malvertising campaign on Bing Search is distributing a fake Claude AI desktop app, leading to SectopRAT malware infections. Verify software sources.Thu, 23 Jul 2026 21:06:56 GMTSectop RATMalvertisingBing AdsClaude AIInformation StealerPhishinghttps://runtimerebel.com/blog/vidar-infostealer-malvertising-campaign-smbs-targeted-by-fake-softwarehttps://runtimerebel.com/blog/vidar-infostealer-malvertising-campaign-smbs-targeted-by-fake-softwareA financially motivated malvertising campaign is actively targeting Small to Medium Businesses, delivering Vidar Infostealer and a cryptominer through fake software…Wed, 08 Jul 2026 17:40:40 GMTVidar InfostealerMalvertisingSMBsCryptominingData TheftPirated Softwarehttps://runtimerebel.com/blog/oxloader-analysis-malicious-google-ads-deliver-castlestealer-malwarehttps://runtimerebel.com/blog/oxloader-analysis-malicious-google-ads-deliver-castlestealer-malwareResearchers have identified OXLOADER, a new malware loader using malicious Google Ads to distribute the CastleStealer information stealer to Windows users.Mon, 22 Jun 2026 14:00:29 GMTOXLOADERCastleStealerMalvertisingGoogle AdsInformation Stealerhttps://runtimerebel.com/blog/operation-flutterbridge-new-fluttershell-backdoor-targets-macoshttps://runtimerebel.com/blog/operation-flutterbridge-new-fluttershell-backdoor-targets-macosResearchers discover Operation FlutterBridge, a malvertising campaign delivering the FlutterShell backdoor to macOS users via Google and YouTube ads.Thu, 04 Jun 2026 13:15:08 GMTFlutterShellOperation FlutterBridgemacOS MalwareJSCoreRunnerMalvertisinghttps://runtimerebel.com/blog/drivesurge-hijacking-thousands-of-sites-for-clickfix-fakeupdate-malwarehttps://runtimerebel.com/blog/drivesurge-hijacking-thousands-of-sites-for-clickfix-fakeupdate-malwareDriveSurge, a wide-scale IAB operation, hijacks thousands of trusted websites using a malicious TDS, redirecting users to sites distributing ClickFix and FakeUpdate…Tue, 02 Jun 2026 21:11:42 GMTDriveSurgeTDSClickFixFakeUpdateSocGholishMalvertisingAd Hijackinghttps://runtimerebel.com/blog/trapdoor-android-ad-fraud-455-apps-generate-659m-daily-bid-requestshttps://runtimerebel.com/blog/trapdoor-android-ad-fraud-455-apps-generate-659m-daily-bid-requestsResearchers reveal the Trapdoor ad fraud scheme, involving 455 Android apps and 183 C2 domains generating over 600 million daily fraudulent bid requests.Tue, 19 May 2026 20:39:59 GMTAndroidAd FraudTrapdoorHUMAN SatoriMalvertisinghttps://runtimerebel.com/blog/claude-ai-malvertising-how-attackers-abuse-shared-chats-for-macos-malwarehttps://runtimerebel.com/blog/claude-ai-malvertising-how-attackers-abuse-shared-chats-for-macos-malwareThreat actors are leveraging Google Ads and legitimate Claude.ai shared chats to distribute macOS infostealers, effectively bypassing traditional web filters.Sun, 10 May 2026 20:19:55 GMTmacOS MalwareClaude AIGoogle AdsMalvertisingInfostealerCuckoohttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignhttps://runtimerebel.com/blog/macsync-stealer-distributed-via-malicious-homebrew-ad-campaignMalicious ads for Homebrew distribute MacSync Stealer, targeting macOS users. Threat actors leverage trusted software to deploy data-stealing malware.Fri, 01 May 2026 20:25:24 GMTMacSync StealerHomebrewmacOSMalvertisingData Thefthttps://runtimerebel.com/blog/google-deploys-gemini-ai-to-combat-malvertising-and-brand-fraudhttps://runtimerebel.com/blog/google-deploys-gemini-ai-to-combat-malvertising-and-brand-fraudGoogle expands the use of Gemini LLMs to detect sophisticated ad scams, blocking 5.5 billion ads and countering AI-generated brand impersonation tactics.Thu, 16 Apr 2026 16:38:55 GMTGoogle GeminiMalvertisingAd SafetyAI in CybersecurityPhishinghttps://runtimerebel.com/blog/mirax-android-rat-bypassing-security-via-malicious-meta-adshttps://runtimerebel.com/blog/mirax-android-rat-bypassing-security-via-malicious-meta-adsMirax Android RAT targets 220,000 users via Meta Ads, turning devices into SOCKS5 proxies. Learn to detect and mitigate this emerging mobile threat.Tue, 14 Apr 2026 12:29:17 GMTMiraxAndroid RATMeta AdsSOCKS5 ProxyMalvertisinghttps://runtimerebel.com/blog/aitm-phishing-campaign-targets-tiktok-business-via-turnstile-evasionhttps://runtimerebel.com/blog/aitm-phishing-campaign-targets-tiktok-business-via-turnstile-evasionSecurity researchers have identified a sophisticated AitM phishing campaign using Cloudflare Turnstile to hijack TikTok for Business accounts for malvertising.Fri, 27 Mar 2026 16:23:55 GMTTiktokAitMPhishingCloudflare TurnstileMalvertisingCredential Hijackinghttps://runtimerebel.com/blog/tax-search-malvertising-deploys-hwaudkiller-to-blind-edr-solutionshttps://runtimerebel.com/blog/tax-search-malvertising-deploys-hwaudkiller-to-blind-edr-solutionsU.S. taxpayers targeted by malvertising campaign delivering ScreenConnect and HwAudKiller to disable security software via vulnerable Huawei drivers.Tue, 24 Mar 2026 20:18:52 GMTMalvertisingHwAudKillerScreenconnectBYOVDGoogle Adshttps://runtimerebel.com/blog/installfix-attacks-malvertising-spreads-fake-claude-ai-codehttps://runtimerebel.com/blog/installfix-attacks-malvertising-spreads-fake-claude-ai-codeInstallFix attacks leverage malvertising and ClickFix-style techniques to spread fake Claude AI code, targeting users of coding assistants and CLI operations.Tue, 10 Mar 2026 00:32:56 GMTInstallFixMalvertisingAI SecurityClaude AISocial EngineeringSoftware Supply Chain