Recent research highlights two (2) growing malware campaigns that show how attackers are exploiting trust and familiarity to bypass security controls. In one campaign, Mac users searching Google for a Claude AI download are lured by sponsored ads that appear legitimate and lead to shared Claude chat pages posing as official setup guides. These guides trick users into pasting Terminal commands that quietly install malware, which runs mostly in memory, changes its code frequently, and steals sensitive data like browser credentials and keychain information. In a separate but equally concerning campaign, a banking trojan called TCLBanker spreads through fake software installers that mimic trusted applications, such as a signed Logitech program. Thus, making the malware harder to detect. Once active, TCLBanker targets users in Brazil, displays convincing fake banking screens to steal login details, and can automatically spread by hijacking WhatsApp and Microsoft Outlook accounts to message trusted contacts. Together, these campaigns show how attackers are increasingly abusing trusted brands, platforms, and everyday tools to lower user suspicion, spread malware quickly, and steal sensitive financial and personal data. CTIX analysts will continue to report on the latest malware strains and attack methodologies.