Threat actors are running malicious Google Ads that redirect macOS users searching for Homebrew to a spoofed Anthropic Claude download page. The page instructs users to paste and run a terminal command that installs the ACR infostealer, harvesting saved passwords, browser session tokens, and credentials from infected machines. Any organization with macOS users who download developer tools is at risk of credential theft and subsequent account compromise, with no software vulnerability to patch, the attack succeeds entirely through social engineering.