Loading story…
A malvertising campaign used sponsored Google search results for Anthropic's Claude to lure macOS users to a legitimate shared conversation page on claude.ai, where they were socially engineered into running a malicious terminal command. Huntress reported that the command fetched MacSync, a multi-stage macOS infostealer and remote access trojan that chains a zsh loader, in-memory AppleScript theft, a persistent Mach-O RAT, and a helper component designed to abuse Screen Recording permissions.
The malware was built to steal a wide range of data from infected Macs, including browser data, Keychain secrets, saved passwords, Telegram sessions, SSH and cloud credentials, and cryptocurrency wallet recovery phrases. The operation also used repeated TCC permission prompts, fake "Apple Support" messaging, and trojanized cryptocurrency wallet applications to deepen access, maintain persistence, and expand theft beyond initial credential harvesting.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
Microsoft Defender Experts correlated recurring endpoint and network behaviors to connect more than 30 domains to MacSync Stealer activity, despite the actor's rapid domain rotation. The report also detailed the malware's ClickFix-style delivery, AppleScript-assisted execution, staging under /tmp/sync* paths, chunked HTTP PUT exfiltration, and published detection guidance and IOCs.
In July, a Huntress customer clicked a sponsored Google Ads result for "How to Install Claude on a Mac" and was redirected to a legitimate shared claude.ai conversation page used as a lure. The page, presented under the display name "Apple Support," instructed the user to paste a malicious curl command into Terminal, which delivered the MacSync malware.
Apple introduced protections in macOS 26.4 aimed at ClickFix-style social engineering, including warnings for suspicious Terminal pastes and XProtect checks. The Microsoft report cited these mitigations as relevant to MacSync Stealer's delivery technique.
After investigating the incident, Huntress analysts reconstructed the malware loader request from Elastic telemetry and retrieved a sample directly from the attacker's servers using a spoofed macOS User-Agent and a static api-key. Their analysis identified MacSync as a six-stage macOS infostealer and RAT chain.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 29 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcemicrosoft.com
Open sourcehuntress.com
Open sourcesupport.apple.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A malicious advertising campaign targeted users seeking help installing **Claude Code** by placing Google Ads that appeared to reference the legitimate `claude.ai` domain and directing victims to attacker-crafted Claude Share pages posing as installation instructions. Researchers reported that the fake guide impersonated Apple support and Claude-related setup content, then pushed victims to run a terminal command whose real payload was obscured with Base64 encoding and shell substitution to hide the download source. The decoded command reportedly fetched the **MacSync** infostealer from attacker-controlled infrastructure and used `curl` with certificate validation disabled, leading to compromise of macOS Keychain contents, browser passwords, session cookies, SSH keys, cloud and developer credentials, Telegram Desktop sessions, and cryptocurrency wallet data. MacSync also established persistence through a LaunchAgent disguised as a Google Keystone updater and could tamper with Ledger Live; responders said any host that executed the command should be treated as fully compromised, isolated, reimaged, and followed by credential rotation, session revocation, and wallet migration.
Jul 28, 2026
Huntress reported a macOS intrusion in which a user searching Google for Claude installation instructions clicked a sponsored result that led to a weaponized public Claude share on `claude.ai`, ultimately triggering installation of **MacSync**, a stealer and remote-access trojan. The infection chain relied on a pasted command executed by the victim, then fetched a server-side AppleScript payload, prompted for **Full Disk Access**, and harvested browser data, keychain contents, wallet information, and other credentials before installing a persistent Mach-O RAT. Investigators said the malware also deployed a helper component to obtain **Screen Recording** permission, expanding the attacker’s visibility on the host. The campaign used delivery domains `agenticsora[.]com` and `malwareaudit[.]com`, a RAT command-and-control endpoint at `85.206.161[.]241:8443`, and seed-phrase collection domains `main.sdhomeinspectors[.]com` and `main.southcarolinacounselor[.]com`. Huntress found that if cryptocurrency wallet applications including **Ledger Live**, **Ledger Wallet**, or **Trezor Suite** were installed, MacSync trojanized those apps in place to phish recovery seed phrases and exfiltrate them to attacker-controlled infrastructure. The researchers assessed that MacSync shares strong lineage with **AMOS/Atomic Stealer** tradecraft, including Russian-language developer artifacts, but goes further by combining credential theft with persistent remote access, screen capture, and wallet-app rewriting.
Aug 3, 2026
Threat actors are running a **ClickFix**-style social-engineering campaign that abuses **Google sponsored search results** to funnel macOS users to malicious content hosted on legitimate platforms, including **Anthropic Claude public artifacts** (`claude.ai`) and **Medium** pages impersonating trusted sources (e.g., Apple Support). The lures target common search queries such as “online DNS resolver,” “macOS CLI disk space analyzer,” and “HomeBrew,” then instruct victims to paste and run Terminal commands that decode/execute payloads (e.g., `echo "..." | base64 -D | zsh` or `curl ... | zsh`). Researchers (Moonlock Lab/MacPaw and AdGuard) reported that the malicious Claude artifact accumulated **~12,300 to 15,600 views**, indicating significant exposure (reported as **10,000+** and **15,000+** potential victims across coverage). The payloads deliver macOS information-stealing malware, including **MacSync**, which collects data such as **Keychain credentials, browser data, and cryptocurrency wallet files**. Reported tradecraft includes downloading and executing a shell script, using an AppleScript component for theft, staging stolen data into `/tmp/osalogging.zip`, and exfiltrating via HTTP POST to attacker infrastructure (e.g., `a2abotnet[.]com/gate`, with C2 paths like `a2abotnet[.]com/dynamic`). The malware attempts to blend in by spoofing legitimate macOS browser User-Agent strings and includes retry logic for large/chunked uploads, then removes staging artifacts to reduce forensic traces.
Jun 29, 2026