A malicious Google Ads campaign impersonating Anthropic’s Claude Code installer is targeting macOS users with a credential-stealing malware strain known as MacSync Stealer.
According to research by Giovanni Braccini of Beelzebub Labs, the operation used a fake Google Sites landing page and a multi-stage terminal-based infection chain to steal macOS credentials, browser data, cloud access tokens, and cryptocurrency wallet information.
Google Ads campaign impersonating Claude Code
The campaign began with a sponsored Google search result shown for queries such as “claude code mac install.” The ad sat above the genuine Anthropic listing, titled “Install Claude macOS,” and pointed to a page built on Google Sites rather than anthropic.com.
That detail matters more than it sounds: Google Sites pages are rendered with JavaScript, so security tools and corporate filters that scan links without actually executing that JavaScript see nothing but an empty template.
A real visitor’s browser, on the other hand, renders the full page, complete with a fabricated download counter and a “copy command” button placed where a real installation instruction would go.
The page goes further than most phishing attempts. It includes a beginner-friendly guide for people who’ve never opened Terminal, walking them through each step with screenshots.
One of those screenshots shows a fake terminal session completing successfully, and buried in that fake output is the line “Write admin password: **** ✓.” Nothing has been installed yet.
The victim hasn’t typed anything. But they’ve already been shown, in advance, that entering their Mac password is just part of the process. When the real prompt appears minutes later, it doesn’t feel like a red flag. It feels like step four of six.
MacSync Stealer Attack Chain
Beelzebub’s researchers, working with their Caronte analysis platform, traced the entire chain from that first click through to the eventual theft of a Ledger hardware wallet’s recovery phrase.
Laid out in sequence, the attack is less a single piece of malware than an assembly line, with each stage handing off to the next.
The chain runs in six connected phases:
- A paid ad impersonates the legitimate tool.
- The ad leads to a cloned install page designed to evade automated scanning.
- The page delivers a Base64-obfuscated terminal command.
- The command triggers a fake system dialog that captures the Mac’s login password.
- Once the password is known, a bulk credential-harvesting stage runs immediately.
- For victims with certain hardware wallets installed, the attack silently and persistently takes over the wallet application itself.
Mac Payload Execution Process
Once the terminal command runs, it quietly downloads a small script, which downloads a larger, compressed script, which finally launches the real payload: an AppleScript program that identifies itself, internally, as “MacSync Stealer,” version 1.1.2.
Tagged with the build name “claude1,” a label that only makes sense if you already know it was built specifically to ride along with a fake Claude Code campaign.
Its first act is to force-quit Terminal, thereby wiping the malicious command from the visible history.
Its second is the one that matters most: it needs the Mac’s login password, and it gets it by displaying a dialog that looks, pixel for pixel, like a genuine macOS system prompt, right down to using Apple’s actual lock icon.
Behind the scenes, it checks each password attempt using a quiet system command that never triggers a real security alert, so it can simply wait until the correct password is typed. That password becomes the master key.
It unlocks the encrypted keychain file where macOS stores saved logins, and it unlocks the specific vault Chrome and other Chromium browsers use to encrypt every password a user has ever asked the browser to remember.
From there, the malware works through a checklist: more than a dozen browsers, dozens of cryptocurrency browser extensions, SSH and cloud credentials, Telegram sessions, Apple Notes, and any sensitive files sitting in the Desktop, Documents, or Downloads folders.
Everything gets zipped into a single archive, ready to be sent out over the internet in small pieces.
Ledger Wallet Time Bomb
For most victims, the theft ends there. But if Ledger Live or Ledger Wallet is installed, the malware behaves considerably more patiently.
Rather than trying to steal a seed phrase immediately, it replaces a core file inside the wallet app itself and re-signs the app so macOS doesn’t flag it as broken. The victim’s actual Ledger application becomes the delivery mechanism.
Inside that altered file sits a single line of injected code, marked with a Russian-language comment that translates to “insert here,” a strong hint that this is a reusable criminal template rather than one-off custom work.
Five seconds after the real Ledger app opens, long enough to look completely normal, that line silently swaps the entire window for a fake “something went wrong” recovery screen, built using Ledger’s own official artwork, that asks the user to re-enter their seed phrase to fix a nonexistent error.
Almost every element here is designed to defeat a specific kind of suspicion. Automated scanners are defeated by a JavaScript-rendered lure page. Human suspicion is defeated by priming victims to expect a password prompt before they see one. Antivirus signature matching is defeated by randomizing variable names on every build.
And even a cautious user who denies a legitimate keychain permission request later doesn’t actually stop anything, because the attacker already has the raw keychain file and the password needed to unlock it offline.
There’s a real weakness in how the malware was built, and it happens to protect some people by accident. Both the data upload and the Ledger app hijack are stuck behind one final popup: a fake error claiming the Mac “does not support this application.”
The script that runs everything pauses completely at that message and can’t continue until someone clicks it away.
In practice, that means a victim who closes their laptop, force-quits Terminal, or restarts their Mac before dismissing that popup never has their stolen data uploaded and their wallet app is never accessed.
The temporary folder that holds everything is erased automatically the next time macOS starts up.
Chain in a Sandbox
For researchers who’d rather watch this chain unfold than take a write-up at face value, an interactive malware sandbox is the fastest way in.
Detonating the dropper (SHA-256: bd348a40261aa2d95566ccdc4e6f304ff25aa97d34e5c713c77c937583ad04f0) inside a service like ANY.RUN puts the whole sequence on screen in real time.
The process tree spawning off the initial zsh script, the outbound calls to oklahomawarehousing.com as each stage phones home, and the moment the fake password dialog gets drawn instead of requiring an analyst to reconstruct all of that from static code alone.
It’s also a reasonable first stop for triage: checking a suspicious hash or URL against a public sandbox’s existing submissions can confirm in seconds whether a sample is already a known variant of this campaign before committing to a full manual teardown.
How to Protect Yourself
Beelzebub reported the ad, and Google removed it within a day for violating its advertising rules, though similar lure pages tend to reappear under new URLs.
The practical takeaway holds regardless of how this particular campaign evolves: install developer tools only from their official documentation or package manager; treat any terminal command containing long encoded strings as an immediate stop sign.
If you’ve ever run a command like this, change your Mac password and rotate saved browser credentials, even if you’re not certain the final dialog was clicked.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
