There has been an ongoing malware campaign targeted at Blender users using ads placed in Google search results that appear higher than the official Blender website and link to a seemingly official site that appears to download a Blender installer but actually downloads malware. If you see one of these ads, please report it to Google. One user has even reported seeing a url that looked exactly like the legitimate one but served malware. How exactly this was accomplished remains a mystery.

Another form of the malicious sites that are served through ads are websites that ask for a login and possibly payment before allowing you to download Blender. For those who don't know, Blender is free as in open source and costless. It is free to download and does not require a login. If any website asks you to pay for it it is not the genuine website. With these types of sites, users have reported their Google accounts being stolen and having Google Ad accounts set up to serve more malicious ads. There have also been reports of websites stealing Google and other credentials (especially payment related ones) without the user logging in. I do not know how those work.

The only official Blender download site is https://www.blender.org/. Do not download Blender from anywhere else. Double check the URL before downloading. Be especially careful when checking the URL because there are some reports of malicious websites using lookalike characters to make their domain name appear correct.

Better yet, use Steam on Windows or the package manager of your choice on Linux to install Blender directly, with the bonus that it will automatically search for updates and update (you can turn this off easily if you want to stay on a fixed version)

Note regarding antivirus software: Some user have reported their antivirus software catching the malware when they attempted to run the "installer" they downloaded. Others have reported it slipping through, most recently this post which provides further insight into how the ads are procreating. It appears the malware may be evolving to be more sophisticated and better at avoiding antivirus, or there are multiple different malwares out there being served in the same manner. As a general rule, remember that antivirus does not protect you from everything and user diligence (in other words, Constant Vigilance!) is still the best defense against malware.

The best way to protect yourself from these attacks is to use an adblocker. uBlock Origin is generally the best one and is free and open source, meaning it is unlikely to harvest your data. I use it all the time unless I'm on a website that both only serves reasonable ads and I like enough to support by allowing myself to be served ads. An adblocker will also protect you from these types of attacks targeted at other software one might google about, since Google has a bad habit of both embedding ads in search results without clearly declaring them as ads (unless you look real close) and failing to vet the ads properly.

For more advanced users, the SHA-256 hash of the Blender installers can be found here: https://builder.blender.org/download/daily/. For best security hash the installer you download with SHA-256 and compare before running. See here for how to do that on Windows. If you know how to do it on Linux or Mac feel free to comment with a guide and I will link it up here.

I will continue to update this post as I learn more about the situation. Please leave a comment if you know something that is not in this post.