What Is Malvertising? When a Helper App Search Becomes the Trap

You plug the Mac mini into a new monitor and everything looks great. Then a video starts, far too loud. You hit the volume key, which never failed you on your MacBook’s built-in screen, and a speaker icon appears with a line through it. The brightness keys do nothing either. So you search for mac external monitor volume control. The top result carries a small “Sponsored” label and promises exactly the feature you are missing.

That moment is where malvertising lives. If you have ever wondered what is malvertising, here is the short answer: paid ads that lead to malware, and on a Mac they are mostly search ads. What follows looks entirely ordinary, right up to the request for Accessibility access, which for this kind of app even makes sense. Afterwards your keys may work perfectly. Whether something else is quietly collecting your passwords at the same time, you cannot tell.

One honest note before we go on. We have not found a documented case of a fake monitor volume app spreading malware. The scene above illustrates a pattern. The evidence comes from other programs, namely TradingView, Microsoft Teams and Claude, and they all follow the same script.

Why your Mac won’t control the monitor

There is a decision behind this gap. HDMI, DisplayPort and Thunderbolt send audio to the monitor as a digital signal at a fixed volume, as MacRumors explained in a 2018 how-to. The monitor decides how loud it gets. macOS just passes the signal along, which is why you see the crossed-out icon. Brightness works the same way in practice: the keyboard handles it on Apple’s own displays, and on most third-party monitors it simply does nothing.

Apple has never explained this choice in detail, but it is easy to follow. Monitors talk to computers over a separate control channel, and how reliably they do that varies wildly between models. An operating system that only drives the displays it knows well avoids a whole category of strange support problems. At your desk, though, all that matters is that the feature is missing and you want it.

That is what helper apps are for. The best known is MonitorControl, an open-source project developed on GitHub for years. BetterDisplay and Lunar do similar things, each with its own website. They speak to the monitor over its control channel and route the Apple keyboard keys there. It works, and it is legitimate. The risk sits somewhere else entirely: on the path you take to get one of these apps.

What is malvertising, and why does it rank first?

The word blends “malicious” and “advertising.” It covers any ad that leads to malware or a scam page, and software downloads are an ideal target because the search itself reveals what the person intends to do. Someone typing “TradingView Mac download” is about to install something. An attacker only has to pay for an ad that appears above the real vendor.

The FBI warned about exactly this in a public service announcement in December 2022. Criminals buy search ads on lookalike domains, the FBI wrote, and the ads appear at the very top of the results with little to set them apart from a normal listing. When the person is looking for a program, the fake page offers a download named after that program, which is malware.

Google fights this at enormous scale. According to its 2025 Ads Safety Report, the company blocked or removed more than 8.3 billion ads that year and suspended 24.9 million advertiser accounts. Of those, 602 million ads and 4 million accounts were tied to scams. Google says it caught over 99 percent of policy-violating ads before anyone saw them.

That is genuinely impressive, and the remainder is still the problem. An ad that slips through lands above every other result and often runs for only a few days, which is long enough for a few hundred downloads.

The criminals rarely use their own accounts for this. In the cases Malwarebytes investigated, the ads ran through other people’s advertiser accounts that had most likely been hijacked. To Google, such an account first looks like a long-standing customer with a clean history.

Three documented cases

In September 2023 the security company Malwarebytes described a campaign aimed at Mac users searching for TradingView, a popular app for tracking stock and crypto prices. The Google ad showed a domain built with special characters to imitate the real name. It led to a convincing copy of the site with download buttons for Windows, Mac and Linux, on a domain registered only days earlier. The Mac download came with a picture showing how to get past macOS’s built-in protection. Once launched, it asked for the user’s password in an endless loop until the victim gave in. After that, browser passwords, keychain entries and crypto wallets went straight to the attackers. The malware was Atomic Stealer, usually called AMOS.

In July 2024 the same pattern returned with Microsoft Teams. This time the ad even displayed microsoft.com as its address. Behind it sat an advertiser account based in Hong Kong running close to a thousand ads with no connection to Microsoft. Each click was screened so that only real people, not bots or researchers on VPNs, reached the malicious page. Malwarebytes says it took days and many attempts before the ad showed its real destination. The installer then asked for the password and for access to files. If you are setting up a new program, none of that feels unusual.

The most recent case is more refined. Huntress, a company that runs security monitoring for businesses, wrote in August 2026 about a customer who had searched in July for how to install Claude on a Mac. He clicked the sponsored result and actually landed on claude.ai, Anthropic’s real domain. What waited there was not an install page but a publicly shared chat, with “Apple Support” as the display name. The chat told him to paste one line into Terminal. What ran next was an infostealer called MacSync, which collects browser cookies and logins, keychain secrets, Telegram sessions and crypto keys.

The last row deserves its own sentence or two. In September 2025 the threat intelligence team at the password manager LastPass reported a large campaign of fake GitHub pages posing as popular Mac programs, LastPass among them. On GitHub, too, what counts is whether you are looking at the vendor’s own project or a copy with a similar name.

In all four cases the malware got in without exploiting any weakness in macOS. It ran because someone launched it, for a good reason, along a route that seemed perfectly sensible at the time.

Why the Accessibility prompt tells you nothing

Back to the monitor. Say you have installed a helper app and launch it. macOS steps in: the program wants to control your Mac through Accessibility features. That is one of the most powerful permissions macOS has. Apple’s own help page says to grant it only to apps you know and trust, and adds that an app with this access can also reach your contacts, calendar and other information.

For a volume app the request still sounds reasonable. The app has to catch your key presses and hand them to the monitor, so it needs to see which key you press. The real MonitorControl asks for exactly this, and its instructions on GitHub say why. Accessibility access is only required if you want to use the Apple keyboard’s media keys. If the sliders in the menu bar are enough, the project says, you can safely skip that step.

For a fake, this is a gift. It asks the same question with the same justification and gets the permission because it fits the purpose so neatly. A program that passes key presses to a monitor can just as easily write them down. From your chair both cases look identical. The keys work and the monitor gets quieter. You have been herded into the trap without making a single mistake you would blame yourself for later.

So the prompt cannot tell you which app you are dealing with. Where the app came from can, and so can everything it asks for beyond that one prompt.

Real helper app or fake: a quick check

A handful of signs come up again and again in the documented cases. None of them proves anything alone. Together they paint a fairly clear picture.

The first row matters most. For software downloads the ad at the top is almost never the best route, however trustworthy it looks. For MonitorControl that means the Lite version in the App Store, or the full version from the project’s GitHub releases page or Homebrew, exactly as the project’s own instructions say. The FBI gave similar advice in its 2022 warning: type the vendor’s address yourself instead of clicking an ad. We walked through the same principle with fake copies of the Tor Browser.

A trusted name in the address bar is not enough either. The Claude case shows the trap can sit on the real domain when a site hosts content from its users, such as shared chats, gists or documents. If a guide hands you a command to paste into Terminal, don’t run it, no matter which site it is on or who it claims to come from.

Even the App Store is no free pass, although the bar is higher there. In 2021 the iPhone App Store carried a copy of the app from wallet maker Trezor. One user typed in his credentials and lost 17.1 bitcoin, worth about $600,000 at the time, as The Washington Post reported. In 2024 a fake topped the results for the crypto wallet Phantom, according to CryptoSlate even as a paid ad inside the store, filed under “Education.” Both cases involved the iPhone, the pattern is the same. In the store, check the developer name and the category before you tap Get.

Check a download’s signature yourself

If you want to know who a download really comes from, your Mac can tell you. Nearly every legitimate macOS program carries a digital signature, and it names the Apple developer account that signed it. A monitor driver from LG should say LG. If it says nothing at all, a private person’s name, or a company you have never heard of, that tells you a lot.

The easiest way needs no Terminal. When you open an installer package ending in .pkg, the installer window shows a lock or certificate icon in its upper-right corner. Click it to see the certificate details. If neither icon is there, the package is unsigned, and according to Apple’s own instructions you shouldn’t install it. For apps and other files there is the free tool What’s Your Sign from Objective-See, the nonprofit foundation of security researcher Patrick Wardle. It adds a “Code Signing Info” item to the Finder’s right-click menu. A green lock means Apple itself, a black lock a registered developer or the Mac App Store, a red open lock a missing or revoked signature. It is one more app to install, though, so get it straight from objective-see.org.

You don’t have to type the path to the file. If you drag the file from the Finder into the Terminal window, macOS fills in the full path, as Apple’s Terminal help explains. For an installer package, Apple’s developer documentation gives this command:

pkgutil --check-signature ~/Downloads/Installer.pkg

A properly signed package shows “Signed with a trusted timestamp” in the output, and the certificate chain has a line starting with “1. Developer ID Installer:”, followed by the developer’s name.

For an app, meaning something ending in .app, codesign shows the signature. The codesign manual page uses this exact form as an example:

codesign --display --verbose=4 /Applications/SomeApp.app

Look at the lines that start with Authority=. In a technical note Apple describes the usual three-level chain: first “Developer ID Application:” with the developer’s name, then “Developer ID Certification Authority”, and finally “Apple Root CA”.

Whether Gatekeeper would let the app through is what spctl answers. Its manual page describes it as the interface to the same assessment system Gatekeeper uses. Apple’s notarization documentation lists the command like this:

spctl -vvv --assess --type exec /Applications/SomeApp.app

For a clean, notarized app the output says “accepted”, plus “source=Notarized Developer ID” and an “origin=Developer ID Application:” line with the developer’s name and team ID. For disk images ending in .dmg, Apple’s Technical Note TN2206 gives a separate variant:

spctl -a -t open --context context:primary-signature -v ~/Downloads/SomeApp.dmg

Apple describes signing a disk image as an option there, not a requirement. If the command finds no signature on an image, open it and check the app inside with the two commands before.

A signature only proves who signed, though. It says nothing about whether the program is harmless. In August 2020 Patrick Wardle found notarized malware: a campaign on homebrew.sh, a lookalike of the real Homebrew site, pushed the Shlayer adware as a fake Flash update, and spctl reported “accepted source=Notarized Developer ID”. The developer names on the signatures were those of two individuals. For a supposed Adobe installer, that alone should have ended the check. Apple revoked the certificates after Wardle reported them, and spctl then flagged the approval as revoked. According to Apple Platform Security that is the normal process: Apple revokes the developer certificates and can issue revocation tickets even for software it previously notarized, which macOS checks for regularly. That takes time, though, and two days after the revocation the Shlayer campaign was still running. If the name in the signature doesn’t match the vendor, delete the file. If it does, that’s a good sign and nothing more.

The bigger pattern: security that sends you on detours

The monitor scene is one case of a broader pattern. A decision that makes sense on its own leaves a gap in everyday use. People find their way around it, and someone is waiting on that detour. For the attacker that is convenient, since the gap is already there. Three more examples show how common this is.

Gatekeeper gets stricter, and attackers ship the instructions

Until macOS Sequoia you could get past the warning for an unknown program with a Control-click. Apple announced in August 2024 that this shortcut would go away. Since then, software that is not properly signed or notarized has to be approved in System Settings under Privacy & Security, which is a sensible hurdle.

The attackers adapted quickly. The fake installers from the cases above already came with their own picture guides for getting around the warning. As that got harder, many campaigns moved to a technique researchers call ClickFix. The victim no longer gets a file at all, just a command to paste into Terminal. Gatekeeper has nothing to check, because from the system’s point of view the user is acting on their own.

Apple responded to that too. Since macOS 26.4, Terminal scans pasted commands before they run. In April 2026, researchers at Jamf still described a variant that skips Terminal entirely and opens Script Editor instead, disguised as a guide to freeing up disk space. Each new hurdle from Apple is the right call, and each one pushes the attack a little further toward persuasion.

The forced password change

Many companies used to make people change their password every 90 days. Well meant, but in practice it creates a detour. If you constantly need a new password, you take the old one and tweak it. Summer2025! turns into Fall2025!.

Researchers at the University of North Carolina measured this back in 2010. They studied password histories from more than 7,700 retired university accounts that had forced regular changes. In 41 percent of accounts, the new password could be worked out from the old one offline within seconds. For 17 percent, fewer than five guesses at the login page were enough on average.

The rulebooks have caught up. NIST, the US federal agency that sets technical standards, now states in its digital identity guidelines that services shall not require people to change passwords periodically. A change is only required when there is evidence that a password has been compromised. If you want to know whether yours has been, our guide on how to check for a data breach walks through it.

Text messages as a second factor

The third detour is the quietest. Many services text you a code when you sign in. That is far better than a password alone. It also ties the account’s security to your phone number, which can sometimes be moved to someone else’s SIM card. NIST therefore classifies delivery over the phone network as restricted and tells services to treat a SIM change or a number port as a risk signal. How such an attack plays out is covered in our piece on SIM swapping, and what can replace text codes is in our article on passkeys.

Can Macs get viruses?

The question comes up almost every time, and the honest answer is yes, with a caveat. Classic viruses that spread from file to file or from machine to machine play almost no role on macOS. What does exist, in quantity, is malware that you start yourself. According to Malwarebytes, Atomic Stealer was first advertised for sale in April 2023 as a toolkit for criminals, focused on crypto wallets and on passwords from browsers and the keychain. MacSync belongs to the same family of infostealers.

These programs do not need a security hole. They need your password, your permission or your command in Terminal, and they get it by telling a good story. An antivirus app can help recognise known variants. macOS ships its own, XProtect, which runs silently in the background. Against a fresh variant you launch with your own hands, though, asking where it came from beats any add-on scanner.

If you already installed something like this

Maybe you are reading this because the table above made you uneasy. Take it one step at a time. Disconnect the Mac from the internet so nothing else leaves, and delete the suspicious program. Then open System Settings and go to Privacy & Security. Under Accessibility, Full Disk Access and Screen Recording, nothing should appear that you do not recognise. Under General you will find Login Items, meaning everything that starts automatically with the Mac. That is the honest answer to how to find malware on a Mac without buying anything.

Removing the program does not bring back what it took. Infostealers grab passwords and logged-in sessions, the cookies that keep you signed in. So change your most important passwords, and do it from a different, clean device. Start with your email, because every other account can be reset through it, then move on to banking, your Apple Account and your password manager. Sign out of all devices wherever a service lets you. If you kept crypto wallets on the Mac, move the funds to a new wallet, because the old keys have to be treated as burned. If anything odd shows up in your bank account, call your bank.

The safest step after that is reinstalling macOS. It costs an afternoon and clears out leftovers you did not find. Other signs that a device has been compromised are in our guide Has my phone been hacked?, which applies to computers more than its title suggests.

What stays with you

Most helper apps are legitimate, MonitorControl included. The dangerous part is the moment before. When your device can’t do something you urgently need, you are more exposed than usual. Searching in a hurry, people tend to click the first result and grant permissions as soon as the reason sounds plausible. That impatience is what the attackers count on, and they pay to be at the top when it strikes.

The protection is unspectacular, and it is not a guarantee. If you skip the ad and go straight to the project page, you have already sidestepped most of these campaigns. In the App Store, check the developer before you download anything. Commands from someone else’s guide do not belong in Terminal, however helpful the page seems. And if a program wants more than its job explains, close the window. Your monitor can stay too loud for one more day.

Frequently asked questions

What is malvertising?

Malvertising is short for malicious advertising: ads that lead to malware or scam pages. On a Mac it usually takes the form of paid search ads. You search for a program, the top result is an ad that looks like the vendor, and behind it sits a copied download page. Google says it stopped more than 99 percent of policy-violating ads before they ran in 2025. The few that slip through still appear above everything else.

Can Macs get viruses?

Yes, though the word virus is a little misleading. Self-spreading viruses are rare on macOS. What is common is malware you start yourself, especially infostealers such as Atomic Stealer (AMOS) and MacSync, which take browser passwords, keychain items and crypto wallets. They rarely beat macOS protections with clever code. They talk you into opening them, typing your password or pasting a command into Terminal.

Is MonitorControl safe?

MonitorControl is a legitimate open-source project developed on GitHub for years. There is a Lite version in the Mac App Store, and the full version comes from the project's GitHub releases page or Homebrew. Its request for Accessibility access is normal and documented in the project's own instructions, and it is only needed for the Apple keyboard media keys. The risk comes from getting it through an ad or a download portal instead of the project page.

How do I find malware on my Mac?

Start in System Settings under Privacy & Security. Look at the lists for Accessibility, Full Disk Access and Screen Recording, and check Login Items under General for anything that starts automatically. Unfamiliar entries are worth investigating. macOS also runs its own built-in scanner, XProtect, in the background. If you suspect an infostealer, assume your passwords and logged-in sessions are gone and change them from a different device.

How do I check if a Mac download is legit?

For an installer package (.pkg), click the lock or certificate icon in the upper-right corner of the installer window. If it is missing, the package is unsigned. In Terminal, pkgutil --check-signature, codesign --display --verbose=4 and spctl --assess show who signed the file and whether Apple notarized it. These commands only read and never need a password. The developer name has to match the vendor. A valid signature only shows who signed, though, and Apple has revoked notarized malware after the fact.

Why can't I change my monitor volume from my Mac over HDMI?

HDMI, DisplayPort and Thunderbolt carry audio to the monitor as a fixed-volume digital signal, so the monitor controls the level. That is why macOS shows a crossed-out speaker when you press the volume keys. Brightness on most third-party monitors is not controlled from the keyboard either, apart from some Apple displays. Helper apps talk to the monitor over its own control channel instead.