Malicious ads are being targeted with fake Homebrew installers for Mac users, relying heavily on the first Google search result. These ads place a fake HomeBrew site above the real one and trick users into running a malicious Terminal command. The tactic is effective as it aligns with routine behavior rather than technical exploits. Fake Homebrew site swaps the legitimate install command for an obfuscated script that runs malware. The command is encoded in Base64, which hides its intent behind harmless-looking text and installs an information stealer. Researchers have tied the payload to AMOS, or Atomic macOS Stealer, which targets browser data, credentials, and crypto wallets. The attack works because it fits into normal setup behavior and the encoding masks obvious red flags.