Cybercriminals are using fake Claude installation guides to infect Mac users with MacSync, a sophisticated information stealer and remote access trojan (RAT).
The campaign abuses sponsored Google search results and a publicly shared page on the legitimate claude.ai domain, making the lure appear trustworthy.
A victim searching for “How to install Claude Code on a Mac” clicked a paid Google advertisement that led to a Claude shared conversation branded as “Apple Support.”
The page instructed the user to paste a command into Terminal to install Claude. Instead, the command downloaded and executed malware.
The malicious command used curl to retrieve an obfuscated payload and pipe it directly into the Z shell (zsh).
This ClickFix-style technique relies on social engineering rather than an exploit: the victim manually runs the attacker’s command in Terminal.
Fake Claude Guide Malware
The first-stage loader was a small zsh script containing a Base64-encoded and gzip-compressed payload. It changed between victims, reducing the value of simple file-hash detections.
Huntress recommends defenders focus on behavioral signals, such as suspicious curl activity combined with Base64 decoding and shell execution.
The next stage fetched AppleScript from attacker-controlled infrastructure and ran it in memory through osascript.
This allowed the operators to keep much of the stealer logic off the victim’s disk and modify it remotely. The malware then attempted to gain Full Disk Access, a macOS permission that enables access to protected user data.
After the victim approved the permission prompt, MacSync displayed a fake system dialog requesting the Mac account password.
It validated submitted passwords using the dscl authentication utility, ensuring attackers received a working credential rather than an incorrect entry.
MacSync steals browser cookies, saved logins, keychain data, SSH keys, cloud credentials, Telegram session data, Safari history, Apple Notes, and files from common user folders.
It also extracts Chromium browser “Safe Storage” keys, which can help decrypt browser cookies and stored credentials.
/tmp/osalogging.zip (Source: huntress)The malware archives collected data as /tmp/osalogging.zip, uploads it to attacker infrastructure, and removes local artifacts afterward.
It also installs a native Mach-O RAT using a LaunchAgent for persistence, giving operators remote shell access, command execution, file transfer, and data theft capabilities.
A separate helper application attempts to obtain Screen Recording permission. Once approved, the RAT can use the helper to capture screenshots while sending the resulting files through its existing command-and-control channel.
The final stage targets cryptocurrency users. MacSync checks for dozens of wallet browser extensions and desktop wallet applications.
It can replace trusted wallet applications, including hardware-wallet companion apps, with trojanized versions that show fake recovery flows. These prompts aim to steal cryptocurrency seed phrases, huntress said.
Unlike passwords, a stolen wallet recovery phrase cannot simply be reset. Anyone holding it can control wallets derived from that seed, even without the original hardware device.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
