Fake Claude Installation Guides Used to Spread MacSync Malware on macOS
Cybercriminals are leveraging fake installation guides for the AI assistant Claude to distribute MacSync, a sophisticated information stealer and remote access trojan (RAT) targeting Mac users. The campaign exploits sponsored Google search results and a publicly shared page on claude.ai, making the malicious links appear legitimate.
How the Attack Unfolds
A victim searching for "How to install Claude Code on a Mac" clicked a paid Google ad redirecting to a Claude-branded conversation disguised as "Apple Support." The page instructed users to paste a command into Terminal, which instead downloaded and executed malware.
The attack relies on social engineering victims manually run the malicious command, which uses curl to fetch an obfuscated payload piped directly into Z shell (zsh). The first-stage loader is a Base64-encoded, gzip-compressed zsh script, with variations between victims to evade simple hash-based detection.
Malware Capabilities & Data Theft
Once executed, MacSync fetches AppleScript from attacker-controlled servers, running it in memory to avoid disk-based detection. The malware then requests Full Disk Access, a high-privilege macOS permission, and displays a fake system dialog to capture the user’s Mac account password validated via dscl to ensure accuracy.
MacSync exfiltrates a wide range of sensitive data, including:
- Browser cookies & saved logins
- Keychain data & SSH keys
- Cloud credentials & Telegram session data
- Safari history & Apple Notes
- Files from common user directories
- Chromium "Safe Storage" keys (used to decrypt browser credentials)
Stolen data is compressed into /tmp/osalogging.zip, uploaded to attacker infrastructure, and deleted from the victim’s system.
Persistence & Remote Access
The malware installs a Mach-O RAT via a LaunchAgent, enabling:
- Remote shell access
- Command execution
- File transfer
- Additional data theft
A separate helper app attempts to gain Screen Recording permission, allowing the RAT to capture screenshots and transmit them to the attackers.
Cryptocurrency Wallet Targeting
MacSync also scans for dozens of cryptocurrency wallet browser extensions and desktop apps, including hardware-wallet companion software. It replaces legitimate wallet apps with trojanized versions, tricking users into entering seed phrases which, once stolen, grant attackers full control over wallets without requiring the original hardware.
The campaign highlights the growing sophistication of macOS malware, combining social engineering, in-memory execution, and multi-stage payloads to evade detection while maximizing data theft.
Source: https://cyberpress.org/fake-claude-guide-malware/
Anthropic TPRM report: https://www.rankiteo.com/company/anthropic
Google TPRM report: https://www.rankiteo.com/company/googlellc
Apple TPRM report: https://www.rankiteo.com/company/appledeveloper
"id": "gooappant1787128134",
"linkid": "googlellc, appledeveloper, anthropic",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Individual Mac Users'}],
'attack_vector': 'Sponsored Google Ads, Social Engineering, Fake Installation '
'Guides',
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['Cookies',
'Keychain files',
'SSH keys',
'Browser credentials',
'Cryptocurrency wallet files'],
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Browser data',
'Credentials',
'Cryptocurrency wallet '
'information',
'Personal notes',
'System access tokens']},
'description': 'Cybercriminals are leveraging fake installation guides for '
'the AI assistant Claude to distribute MacSync, a '
'sophisticated information stealer and remote access trojan '
'(RAT) targeting Mac users. The campaign exploits sponsored '
'Google search results and a publicly shared page on '
'claude.ai, making the malicious links appear legitimate.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'Claude and Apple due to misuse of '
'branding',
'data_compromised': 'Browser cookies, saved logins, Keychain data, '
'SSH keys, Cloud credentials, Telegram session '
'data, Safari history, Apple Notes, Chromium '
"'Safe Storage' keys, Cryptocurrency wallet "
'seed phrases',
'identity_theft_risk': 'High (due to stolen PII and credentials)',
'operational_impact': 'Remote access to compromised systems, Data '
'exfiltration, Potential financial theft via '
'cryptocurrency wallets',
'payment_information_risk': 'High (due to stolen browser '
'credentials and cryptocurrency '
'wallets)',
'systems_affected': 'macOS systems'},
'initial_access_broker': {'backdoors_established': 'LaunchAgent persistence, '
'Remote Access Trojan '
'(RAT)',
'entry_point': 'Sponsored Google Ads, Fake Claude '
'installation guides',
'high_value_targets': 'Cryptocurrency wallet users, '
'macOS users with sensitive '
'data'},
'motivation': 'Data Theft, Financial Gain, Remote Access',
'post_incident_analysis': {'corrective_actions': 'Improved macOS security '
'policies, User education on '
'Terminal command risks, '
'Enhanced monitoring for '
'suspicious LaunchAgents',
'root_causes': 'Social engineering, Lack of user '
'awareness, macOS permission abuse '
'(Full Disk Access, Screen '
'Recording)'},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Avoid executing unverified Terminal commands',
'Enable macOS Gatekeeper and verify app sources',
'Monitor for unusual LaunchAgent installations',
'Use hardware wallets for cryptocurrency with offline '
'seed storage',
'Educate users on social engineering risks'],
'references': [{'source': 'Cybersecurity Research Report'}],
'title': 'Fake Claude Installation Guides Used to Spread MacSync Malware on '
'macOS',
'type': 'Malware Distribution',
'vulnerability_exploited': 'User execution of malicious Terminal commands, '
'Lack of macOS Gatekeeper enforcement for '
'script-based payloads'}