{"id":20364,"date":"2026-07-02T18:45:29","date_gmt":"2026-07-02T17:45:29","guid":{"rendered":"https:\/\/innovatenews.site\/index.php\/2026\/07\/02\/malware-found-spreading-through-sponsored-ads-on-x\/"},"modified":"2026-07-02T18:45:32","modified_gmt":"2026-07-02T17:45:32","slug":"malware-found-spreading-through-sponsored-ads-on-x","status":"publish","type":"post","link":"https:\/\/innovatenews.site\/index.php\/2026\/07\/02\/malware-found-spreading-through-sponsored-ads-on-x\/","title":{"rendered":"Malware found spreading through sponsored ads on X"},"content":{"rendered":"
\n

The topic Malware found spreading through sponsored ads on X<\/strong> is currently the subject of lively discussion \u2014 readers and analysts are keeping a close eye on developments.<\/p>\n

This is taking place in a dynamic environment: companies\u2019 decisions and competitors\u2019 reactions can quickly change the picture.<\/p>\n

Jamf Threat Labs, the company\u2019s security research arm, recently shared details of a ClickFix-style attack it spotted running as a sponsored ad on the social media site X. Originating from a well-known verified account, it promoted a malicious domain under the guise of a popular Mac app.<\/p>\n

The ad in question was posing as DynamicLake, a legitimate Mac utility that turns your MacBook\u2019s notch into an unofficial but fully working Dynamic Island.<\/p>\n

But per Jamf\u2019s investigation, the original link seen above redirects to dynamicmacisland[.]com, a malicious lookalike domain with no ties to the actual app.<\/p>\n

Once there, visitors were instructed to open Terminal and paste installation code that would quietly install malware on the victim\u2019s Mac. This is a classic technique that defines ClickFix social engineering attacks.<\/p>\n

Legitimate apps, which are signed and notiorized by Apple, will never ask you to do this.<\/p>\n

Jamf identified the payload as a recent Atomic Stealer variant, which it tracks as MacSync. There have also been cases of DigitStealer identified in this attack too.<\/p>\n

\"\"<\/figure>\n

The ad came from a verified account with a fairly large following, which makes this all the more interesting and more dangerous. I\u2019ve chosen to keep the account name anonymous to protect the owner\u2019s identity, because they didn\u2019t set out to spread malware.<\/p>\n

By all appearances, the owner trusted the ad and approved it for their account, believing it was legitimate, with no idea it led to a malicious domain. A verified badge and a familiar name lend a level of trust a random account never could.<\/p>\n

Trust is the basic foundation of any good social engineering attack too.<\/p>\n

The account owner getting fooled is one thing. X approving the ad and pushing it out as a promoted post is another.<\/p>\n

This ran through X\u2019s ad system, checks and all, and still reached users. The lookalike domain and single redirect were almost certainly there to help slip past any of X\u2019s automated scans. And it worked\u2026<\/p>\n

This should give you d\u00e9j\u00e0 vu many times over. In recent years, we\u2019ve seen Google Ads approve an exorbitant number of malicious domains that were promoted at the top of Google Search. One case last year involved the promotion of fake Homebrew listings in search results that distributed malware to Mac users.<\/p>\n

9to5Mac reached out to X for comment and didn\u2019t immediately hear back.<\/p>\n

\"\"<\/figure>\n

While this is the first instance we\u2019ve seen of malware promoted through ads on X, the developer of the real DynamicLake has been fighting malicious clones for a while now.<\/p>\n

The fakes have become so widespread that they reached out to 9to5Mac directly and asked to share a statement in this piece:<\/p>\n

I\u2019m truly sorry to anyone who wanted to install DynamicLake but ended up downloading this malware instead. DynamicLake is simply an app that brings the Dynamic Island for Mac, and I never imagined someone would abuse the brand this way.<\/p>\n

I\u2019m working hard to fight these fake copies, but unfortunately new ones keep appearing every few months. I won\u2019t give up protecting the project and the community.<\/p>\n

If you need any help or aren\u2019t sure whether you downloaded the legitimate app, feel free to reach out to me. Please make sure you download DynamicLake only from DynamicLake.com, where purchases are securely handled through Gumroad.<\/p>\n

Thank you for your support, and again, I\u2019m sorry for the inconvenience.<\/p>\n

Jamf Threat Labs reported the ad to X and it was removed fairly quickly.<\/p>\n

Is X doing enough to keep malicious ads off the platform, or is this an impossible battle to win? Let me know your thoughts in the comments.<\/p>\n

Get more from Arin Waichulis in the 9to5Mac Security Bite weekly-column and bi-weekly podcast.<\/p>\n