MacSync Malware Campaign Targets macOS Users via Fake Claude AI Guides
A newly uncovered macOS malware campaign, dubbed MacSync, exploits fake Claude AI installation guides to deploy a sophisticated six-stage stealer and remote access trojan (RAT). Discovered by Huntress, the attack targets browser credentials, keychain secrets, cryptocurrency wallets, and other sensitive data.
The campaign begins when victims search for "how to install Claude on a Mac" and click a malicious Google-sponsored ad, redirecting them to a weaponized claude.ai/share page disguised with a fake "Shared by Apple Support" badge. The page instructs users to execute a Base64-obfuscated curl command in Terminal, which fetches a loader from domains like agenticsora[.]com or malwareaudit[.]com while bypassing certificate validation.
The malware unfolds in six stages, starting with a polymorphic zsh loader that establishes persistence via a background daemon. Subsequent stages include an AppleScript that tricks users into granting Full Disk Access, harvests credentials, and installs a Mach-O RAT written in C++ with OpenSSL. The RAT persists through a LaunchAgent mimicking legitimate updaters (e.g., Google Keystone, Adobe ARM) and deploys a helper app named "Screen Recording" to gain screen-capture permissions.
The final stage trojanizes hardware-wallet companion apps including Ledger Live, Ledger Wallet, and Trezor Suite to phish seed phrases. Huntress reports the stealer targets 60+ wallet browser extensions, 21 desktop wallet apps, and three trojanized hardware wallet tools, indicating cryptocurrency theft as the primary objective.
Infrastructure spans Cloudflare-fronted delivery domains, an operator panel at 103.216.221[.]95, and a raw-IP TLS channel (85.206.161[.]241:8443) for RAT control. Stolen data is exfiltrated to domains like sdhomeinspectors[.]com and southcarolinacounselor[.]com. Russian-language comments in the source code and collection techniques suggest ties to the AMOS/Atomic Stealer lineage, though researchers note this as a family resemblance rather than confirmed shared authorship.
Detection relies on behavioral indicators, including curl commands piped into zsh, osascript bridges executing stealer logic, and unexpected Full Disk Access or Screen Recording grants tied to newly signed apps. Persistence artifacts include paths like ~/.local/com.apple.<8hex>.hcpi and mutex files at /tmp/macsync_
Source: https://gbhackers.com/macsync-stealer-rat-uses-fake-claude-guides/
Ledger TPRM report: https://www.rankiteo.com/company/ledgerhq
"id": "led1785572706",
"linkid": "ledgerhq",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'location': 'Global (targeted via Google ads)',
'type': 'Individual macOS users'}],
'attack_vector': 'Malicious Google-sponsored ad, fake installation guides',
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Browser credentials',
'Keychain secrets',
'Cryptocurrency wallets',
'Seed phrases',
'Personally identifiable '
'information']},
'description': 'A newly uncovered macOS malware campaign, dubbed *MacSync*, '
'exploits fake Claude AI installation guides to deploy a '
'sophisticated six-stage stealer and remote access trojan '
'(RAT). The attack targets browser credentials, keychain '
'secrets, cryptocurrency wallets, and other sensitive data.',
'impact': {'data_compromised': 'Browser credentials, keychain secrets, '
'cryptocurrency wallets, seed phrases, '
'sensitive data',
'identity_theft_risk': 'High',
'payment_information_risk': 'High (cryptocurrency wallets)',
'systems_affected': 'macOS systems'},
'initial_access_broker': {'backdoors_established': 'Polymorphic zsh loader, '
'LaunchAgent persistence',
'entry_point': 'Malicious Google-sponsored ad, fake '
'Claude AI installation guide',
'high_value_targets': 'Cryptocurrency wallet users'},
'investigation_status': 'Ongoing',
'motivation': 'Cryptocurrency theft, data exfiltration',
'post_incident_analysis': {'root_causes': ['Social engineering via fake '
'installation guides',
'Obfuscated command execution',
'Deceptive Full Disk Access '
'requests']},
'ransomware': {'data_exfiltration': True},
'recommendations': ['Avoid executing obfuscated curl commands from untrusted '
'sources',
'Verify Full Disk Access and Screen Recording permissions '
'for unexpected apps',
'Monitor for persistence artifacts (e.g., '
'~/.local/com.apple.<8hex>.hcpi, '
'/tmp/macsync_.lock)',
'Use behavioral detection for osascript bridges and '
'unexpected zsh executions'],
'references': [{'source': 'Huntress'}],
'response': {'enhanced_monitoring': 'Behavioral indicators (e.g., curl '
'commands piped into zsh, osascript '
'bridges, unexpected Full Disk Access '
'grants)',
'third_party_assistance': 'Huntress (discovery and analysis)'},
'title': 'MacSync Malware Campaign Targets macOS Users via Fake Claude AI '
'Guides',
'type': 'Malware Campaign',
'vulnerability_exploited': 'Social engineering, obfuscated curl command '
'execution, Full Disk Access deception'}