A newly disclosed macOS malware campaign dubbed MacSync weaponizes fake Claude AI installation guides to deploy a six-stage stealer and remote access trojan. Documented by Huntress, the kit targets browser credentials, keychain secrets, and cryptocurrency wallets.
The attack begins when victims search Google for “how to install Claude on a Mac” and click a sponsored ad rather than the organic Anthropic result, landing on a weaponized claude.ai/share conversation disguised with a fake “Shared by Apple Support” badge.
The page instructs users to paste a Base64-obfuscated curl command into Terminal, which silently fetches a loader from agenticsora[.]com or malwareaudit[.]com while bypassing certificate validation.
MacSync Stealer RAT Uses Fake Claude Guides
Because the lure lives on Anthropic’s own trusted domain, there is no lookalike URL or certificate warning to raise suspicion, which makes the social engineering unusually convincing.
MacSync unfolds in six interlocking stages rather than a single payload, and each stage sets up the one that follows. The first two stages consist of a thin, polymorphic zsh loader that inflates a background daemon, which in turn fetches server-side AppleScript and later exfiltrates the stolen archive over HTTP.
claude.ai (Source: Huntress)Stage three is the real workhorse, a roughly 46KB AppleScript that tricks victims into granting Full Disk Access through a fake system dialogue, validates a real account password using the dscl authonly command as a silent oracle, and then harvests browser Safe Storage keys, keychain secrets, SSH and cloud credentials, and Telegram sessions.
Stage four installs a native Mach-O RAT written in C++ with a statically linked OpenSSL stack, persisting through a LaunchAgent that frequently masquerades as a legitimate updater such as Google Keystone, Adobe ARM, or Microsoft AutoUpdate.
Stage five is a separately signed helper app deliberately named “Screen Recording” so that its TCC permission prompt reads like a native macOS request, quietly winning screen-capture access for the operator.
The final stage rewrites trusted hardware-wallet companion apps, including Ledger Live, Ledger Wallet, and Trezor Suite, so that a normal-looking launch leads to a fake recovery flow that phishes the victim’s seed phrase.
Huntress stated that the stealer is built to target roughly 60 wallet browser extensions, 21 desktop wallet applications, and three trojanized hardware wallet companion apps, underscoring that crypto theft is the campaign’s central objective rather than a side effect.
The operation is split across distinct infrastructure tiers, combining Cloudflare-fronted delivery domains with a separate operator panel IP address, 103.216.221[.]95, recorded in stealer beacons, and a dedicated raw-IP TLS channel at 85.206.161[.]241:8443 used for hands-on RAT control.
Stolen seed phrases are ultimately sent to attacker-registered domains including sdhomeinspectors[.]com and southcarolinacounselor[.]com through a shared wallet-exfiltration endpoint.
Russian-language comments left throughout the source code, along with macOS collection techniques and a self-reported “MacSync Stealer” build tag, tie the kit to the broader AMOS or Atomic Stealer lineage, though researchers describe this as a family resemblance rather than confirmed shared authorship.
Because file hashes and per-build identifiers change with every compiled sample, defenders are advised to anchor detection on behavior rather than static signatures.
Indicators of Compromise
| IOC Type | Value |
|---|---|
| Delivery domains | agenticsora[.]com, malwareaudit[.]com |
| Operator IP | 103.216.221[.]95 |
| RAT C2 | 85.206.161[.]241:8443 |
| Seed drop domains | sdhomeinspectors[.]com, southcarolinacounselor[.]com |
| Persistence path | ~/.local/com.apple.<8hex>.hcpi with paired .mpwd file |
| Mutex artifact | /tmp/macsync_<token>.lock |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Huntress recommends monitoring for curl commands piped directly into zsh, osascript bridges used to fetch and execute stealer logic on the fly, ad hoc signed applications that impersonate Apple through com. apple-prefixed bundle identifiers, and outbound network requests carrying seed-phrase-style JSON payloads.
Any unexpected Screen Recording or Full Disk Access grant tied to a newly signed or re-signed application bundle should also be treated as a high-priority indicator of compromise.
ALERT: 20+ government sites delivered malware to businesses and citizens. See full attack research to check your own exposure.
