Threat actors have exploited Google Ads and Anthropic’s Claude shared-chat feature to distribute the MacSync Stealer to macOS users.
They used a social engineering technique called ClickFix, designed to steal credentials, browser data, cloud keys, sensitive files, and cryptocurrency wallets.
According to Zscaler Threat Hunting, this campaign took place between June 12 and June 19, 2026, and the malicious Claude chats became inaccessible after the company alerted Anthropic.
Google Ads and Claude AI Chats to Steal macOS Credentials
The campaign began when a user searched Google for terms like “Claude download,” “Claude AI,” “Claude code,” or “Claude Mac.” Attackers purchased advertisements that redirected victims to a legitimate Claude shared chat URL, creating a strong illusion of trust because the content was hosted on the official Claude domain.
The chats were reportedly branded as being “Shared by Apple Support,” likely through an attacker-controlled display name. They instructed visitors to paste a Terminal command to install or repair Claude.
Rather than delivering a conventional malicious application, the operation relies on ClickFix. This technique manipulates victims into manually pasting and executing commands.
The command uses curl and Base64 obfuscation to retrieve a malicious shell script from the attackers’ infrastructure, then pipes its output directly into zsh.
The initial script Base64-decodes and gzip-decompresses a second-stage payload before executing it using eval, providing attackers with an efficient multi-stage infection path while obscuring the final destination from casual inspection.
The second-stage script suppresses visible output by redirecting it to /dev/null, then fetches the core payload through a `/dynamic?txd=` endpoint using a hard-coded API key.
The downloaded content is piped to osascript, a method that minimizes the payload’s on-disk footprint. After completing the theft, the malware packages the collected data into `/tmp/osalogging.zip` and uploads it in 10 MB chunks via HTTP PUT. It can retry failed uploads up to eight times before deleting the archive to limit forensic traces.
MacSync Stealer seeks extensive access to user data. It tries to access the Cookies directory and, if blocked, modifies the user’s `.zshrc` file to establish persistence whenever Terminal is opened.
It also displays a deceptive “Full Disk Access required!” prompt. It opens the macOS Security & Privacy settings and attempts to persuade victims to grant the necessary permissions for broader data collection. If access is granted, the malware removes its persistence command and proceeds to steal data.
The information stealer copies macOS Keychain databases, Chromium and Gecko browser credential artifacts, password-manager extension data, shell histories, SSH, AWS, and Kubernetes configuration material, Telegram desktop files, as well as documents from the Desktop, Downloads, and Documents folders.
It specifically searches for extensions related to web-based cryptocurrency wallets. It collects data from desktop wallet applications into separate folders.
The malware also employs a fake macOS password prompt to capture credentials. It gathers information about the system, hardware, graphics, processes, and applications.
Zscaler identified Russian-language comments in the third-stage AppleScript, suggesting that the operator may be Russian-speaking.
Researchers also observed the adversary using a large cluster of domains styled as U.S. local-service websites, likely to make the staging infrastructure appear less suspicious.
Organizations are advised to block known domains and monitor for unusual activity such as curl commands in zsh, modifications to .zshrc, temporary archive creation, and outbound HTTP PUT activity from macOS endpoints.
Indicators of Compromise
| Type | Indicator |
|---|---|
| First-stage delivery | lasvegaslaminateflooring[.]com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb |
| Core payload endpoint | lasvegaslaminateflooring[.]com/dynamic?txd=0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb |
| Wallet-targeted payload | lasvegaslaminateflooring[.]com/ledger/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb |
| Potential Ledger Live payload | lasvegaslaminateflooring[.]com/ledger/live/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb |
| Potential Trezor payload | lasvegaslaminateflooring[.]com/trezor/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb |
| Temporary collection archive | /tmp/osalogging.zip |
| Persistence artifact | Modification of ~/.zshrc |
| Detection names | HTML.Trojan.ClickFix; OSX.PWS.MacSync |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.
