MacSync Stealer

Homebrew Maintainer Slams Google Over Malicious Ads in Binance Supply Chain Breach

Homebrew project maintainer Mike McQuaid publicly criticized Google for failing to remove malicious advertisements that led to the compromise of a Binance engineer. The attack began when the Wallet DevOps engineer searched for the legitimate Homebrew package manager and clicked a sponsored result that delivered a trojanized installer. The malicious binary installed MacSync Stealer, exposing credentials and infrastructure details that attackers later used in a multi-stage campaign against the cryptocurrency exchange. Binance confirmed the initial vector was a supply-chain compromise rather than the widely reported fake job application. McQuaid stated that Homebrew has warned Google about the abuse of its name in paid ads for years, accusing the company of prioritizing revenue from malware distributors. The incident highlights ongoing risks to open-source package managers when search engines display unvetted sponsored links above official project sites.