A new malvertising campaign is targeting macOS users with the MacSync infostealer, using a fake Claude Code install guide distributed through Google Ads. This social engineering attack tricks users into running a malicious command, risking credential theft and account compromise.
Malvertising Campaign Impersonates Claude Code Install Guides
The attack leverages paid Google Ads that display claude.ai as the destination, redirecting users to legitimate Claude shared-chat pages. These pages are carefully crafted to appear as official Apple Support or installation guides for Claude Code, a popular AI tool. When a user searches for installation help—using terms like “claude download”—the top sponsored result leads to these deceptive chat pages.
The malicious guides instruct users to copy and paste a single command into their macOS Terminal. Because the destination appears trustworthy and uses real Claude infrastructure, many users are unlikely to question the legitimacy of the provided instructions.
- Target audience: macOS developers and IT staff searching for Claude Code installation help
- Lure mechanism: Google Ads with spoofed claude.ai links and shared Claude chat guides
- Deceptive element: Use of real Claude shared-chat URLs for added legitimacy
Both Zscaler and Deriv AI analysts have tracked the campaign, confirming that the malicious chats were live and accessible via Google search ads in June and July 2026. Anthropic, the developer of Claude, was notified and removed the shared chats after the discovery.
Technical Analysis: How MacSync Infests macOS Devices
The core of this attack is a Base64-obfuscated one-liner provided to users within the fake Claude install guide. This command is specifically designed to conceal its true function and destination from the casual observer.
Obfuscated Command and Loader Operation
When pasted into Terminal, the command uses shell substitution to decode a Base64 string, which is then executed as a curl request. Crucially, it employs the -k flag to bypass TLS certificate validation, allowing it to pull a loader script directly from attacker-controlled infrastructure. The fetched loader is piped into the shell for immediate execution without being saved to disk first.
- Obfuscation technique: Base64 encoding combined with shell substitution
- Command behaviour: Decodes and executes a remote shell script via curl, ignoring certificate errors
- Execution chain: First-stage loader profiles the system, fetches a second-stage payload, and executes it
The second-stage payload is the MacSync infostealer. In similar campaigns, execution may proceed via osascript, allowing the malware to run without a traditional app bundle or user prompts.
MacSync Capabilities and Exfiltration Patterns
MacSync is a sophisticated information stealer tailored for macOS. Once active, it collects a wide array of sensitive data, including:
- Keychain contents (passwords, certificates, secure notes)
- Web browser passwords and cookies
- Session tokens for single sign-on and cloud services
- SSH private keys and configuration files
- Cryptocurrency wallet data
Exfiltration is performed using rotating command-and-control (C2) domains. Data is chunked into archives—typically around 10 MiB each—and sent over cleartext channels in some observed cases. In recent analyses, domains like jacksonvillemma[.]com have been linked to MacSync C2 infrastructure, with credentials transmitted in plain text to specific endpoints.
Timeline and Current Exploitation Status
- 9 March 2026: Malwarebytes documents fake Claude Code install guides delivering infostealers to both Mac and Windows users.
- 12–19 June 2026: Zscaler tracks live abuse of Google Ads and Claude shared chats to distribute MacSync. Malicious shared chats are removed after notification to Anthropic.
- 28 July 2026: Deriv AI’s detailed analysis is published, confirming the continued use of Base64-obfuscated commands and MacSync payloads in the wild.
This is not a theoretical risk. The campaign has been actively exploited, with researchers confirming live distribution and successful infection of macOS users who followed the compromised installation guides. The threat actor behind the campaign remains unattributed, but MacSync itself is available as malware-as-a-service and has been observed in multiple attack chains.
There is no software vulnerability exploited in this attack. The infection relies entirely on social engineering—users must manually copy and run the supplied Terminal command. This method, known as a “ClickFix” chain, bypasses many traditional security controls.
Indicators of Compromise and Defensive Guidance
While campaign-specific indicators were not published in the initial reports, recent MacSync operations have revealed typical IOCs:
- Domains:
jacksonvillemma[.]com(used for payload delivery and C2) - Paths:
/dynamicendpoint on C2 domains - Network: Rotating hostnames and repeated API keys, ZIP exfiltration in 10 MiB chunks
Organisations should monitor for outbound connections to these domains and endpoints, especially following unusual Terminal activity. Endpoint detection should be tuned to flag suspicious use of curl with remote script execution, particularly when certificate validation is skipped.
Anthropic advises users to rely exclusively on official Claude Code installation documentation and to avoid copying commands from shared chat links or sponsored search results. Policy controls that prevent direct shell execution of remote scripts can further reduce the risk of compromise.
Why This Matters and What Organisations Should Do
This campaign demonstrates how attackers can weaponise trusted platforms and search advertising to reach technical users. UK small and mid-sized businesses with macOS developers or IT staff are particularly exposed, as the workflow targeted—searching for install guides and pasting Terminal commands—is common practice.
- Verify all installation commands against official product documentation
- Raise awareness of ClickFix-style attacks among technical staff
- Implement technical controls to block execution of remote scripts in the shell
By understanding the specifics of this campaign, organisations can better defend against similar malvertising and social engineering threats targeting their users.
Originally reported by cybersecuritynews.com.
