ClaudeFix Campaign Abuses Shared Claude Chats to Deliver MacSync Stealer

A new ClickFix campaign that abuses Anthropic’s Claude platform to distribute MacSync Stealer, a macOS-targeted information stealer capable of harvesting credentials, sensitive files, and cryptocurrency wallet data.

The campaign, dubbed “ClaudeFix” internally by Zscaler, marks a notable evolution in ClickFix tactics, replacing typical fake CAPTCHA or browser error lures with shared Claude chat links to lend the attack an air of legitimacy.

ClickFix, first observed in 2024, tricks victims into copying and pasting “fix” commands into their terminal or run dialog, which secretly execute malware.

ClaudeFix Campaign Abuses Shared Claude Chats

By hosting these instructions on Claude’s official domain via its shareable chat feature, attackers exploit user trust in a well-known AI platform. Zscaler notified Anthropic, and the malicious chats were taken down.

The attack begins with malvertising. Victims searching for terms like “claude download” or “claude mac” encounter paid Google ads that lead to a shared Claude chat labeled “Shared by Apple Support,” a name the attacker simply set as their Claude display name to spoof authenticity.

The chat instructs users to run a Base64-Encoded curl command piped to zsh that fetches a first-stage script from attacker-controlled infrastructure.

That script decodes and decompresses a second-stage payload and executes it via eval. This stage suppresses all output, downloads a third-stage AppleScript payload using a hardcoded API key, and pipes it directly to osascript, leaving no file on disk.

It also handles exfiltration: once stolen data is compressed into /tmp/osalogging.zip, the script uploads it in 10MB chunks via HTTP PUT requests, retrying failed chunks up to eight times before deleting all local traces.

The third-stage payload does the heavy lifting. It first checks Keychain access to gauge privilege level; if access fails, it modifies ~/.zshrc for persistence and prompts the user for Full Disk Access.

Once elevated, MacSync Stealer harvests keychain files, Chromium and Firefox browser credentials, password-manager extension data, SSH/AWS/Kubernetes keys, Telegram data, and documents matching sensitive file extensions (.pdf, .key, .wallet, .kdbx, and more).

It also specifically targets crypto wallet browser extensions and desktop apps, and if it detects Ledger or Trezor software, it attempts to download what are likely trojanized replacement installers.

Zscaler’s visibility into Zscaler Internet Access (ZIA) logs revealed the campaign ran from June 12–19, 2026, using 22 unique Google Ads campaign IDs and seven search-term variants, including a Chinese-language term (“claude 客户端”).

The malicious infrastructure followed a consistent naming pattern mimicking U.S. local service businesses domains like lasvegaslaminateflooring[.]com and miamipcsupport[.]com likely chosen to blend in with legitimate ad traffic and evade takedown scrutiny.

Zscaler confirmed that Russian-language code comments in the AppleScript payload (e.g., referencing a “fragile SafeSQLiteCopy” function that “frequently crashed when Firefox was running”) suggest a likely Russian-speaking developer behind the stealer.

MacSync Stealer’s operators have shifted from fake “cracked” software lures to ClickFix, and now to abusing AI platform trust signals a pattern likely to spread as AI tools become higher-value targets for social engineering.

Organizations should treat “paste-and-run” instructions from any source, including trusted platforms, as a red flag, and monitor for anomalous zsh/osascript execution chains on macOS endpoints.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent critical incidents and financial loss with stronger proactive defense. Integrate a live threat feed from 15K SOCs