MacSync Malware Uses Fake Claude AI Install Guide on macOS to Steal Crypto Wallets

A newly documented six-stage macOS malware campaign called MacSync is using a poisoned Google ad and a weaponized Claude.ai share link to trick users into pasting a single Terminal command one that ultimately hands attackers browser logins, keychain secrets, and, most damagingly, the recovery phrases to their crypto wallets.

Huntress researchers traced the intrusion back to a victim who simply searched Google for “how to install Claude Code on a Mac” and clicked what appeared to be a helpful result.

That result was a paid Google Ads placement ranked above the legitimate anthropic.com listing, a classic case of modern malvertising where an attacker buys ad space pointing to infrastructure they control rather than deploying an exploit.

MacSync Malware Uses Fake Claude AI

The ad’s destination was, notably, a real claude.ai/share link, Anthropic’s own feature for publishing chat transcripts publicly, which the operator abused by titling the shared conversation “Running Claude Code on Mac” and badging it as “Shared by Apple Support”.

Because the page lived on claude.ai over HTTPS, there was no lookalike domain and no certificate warning for the victim to notice, which is precisely what made the lure so effective.

The fake install guide walked the user through opening Terminal and pasting a single obfuscated curl command, one that decoded to a hidden download URL and piped the response directly into zsh without ever saving a file to disk.

“What makes MacSync alarming isn’t its technical sophistication; it’s how unremarkable each individual step looks. A sponsored ad, a trusted AI vendor’s own domain, and a command the user types themselves.

Security teams have spent two decades training users to distrust suspicious links and unsigned attachments; this campaign weaponizes exactly the things we told people to trust instead.”

Unlike a typical smash-and-grab infostealer, MacSync unfolds in six distinct, interlocking stages, each engineered to enable the next.

A thin zsh loader (stage 1) inflates a background payload (stage 2) that fetches a server-side AppleScript stealer (stage 3) deliberately kept off the victim’s disk and gated behind an API key, allowing the operator to modify its behavior at will.

That AppleScript does the heavy lifting: it manipulates the victim’s ~/.zshrc file to force a Terminal restart, tricks the user into granting Full Disk Access, then runs a fake “System Preferences”.

Dialog that validates a typed password against macOS’s Open Directory service using dscl. authonly means the operator walks away with a password that has been confirmed to actually work.

From there, stage 4 drops a native Mach-O remote access trojan (RAT) written in C++ that persists via a LaunchAgent, often disguising itself as legitimate updater software from vendors like Google Keystone, Adobe, or Dropbox.

Stage 5 is a separately signed helper app cleverly named “Screen Recording” so that macOS’s permission prompt reads like a native system dialog, allowing the RAT to rent screen-capture capability without needing that access itself.

The most consequential stage is the last one. If MacSync finds crypto wallet apps already installed, including Ledger Live, Ledger Wallet, and Trezor Suite, it copies the app bundle, swaps in a trojanized payload, and re-signs it with an ad-hoc signature so it still launches normally.

A few seconds after the victim next opens what they believe is their own wallet app, the tampered software force-navigates to an injected phishing page that mimics the wallet’s branding and demands the 24-word BIP39 recovery seed phrase, which it then transmits to an attacker-controlled server.

Josh Kiriakoff found that the Ledger Live and Ledger Wallet payloads were byte-identical in 26 of 30 files, confirming that a single phishing kit was repurposed across both apps.

The stakes here are categorically higher than a stolen password: possession of a wallet’s seed phrase means permanent, irreversible control over every account derived from it, with no device reset or recovery option available to the victim.

The operation runs on cleanly separated infrastructure: Cloudflare-fronted delivery domains (agenticsora[.]com and malwareaudit[.]com) serve the malware stages, a separate IP (103.216.221[.]95) functions as the operator’s panel, and a dedicated raw-IP TLS channel (85.206.161[.]241:8443) handles live RAT command-and-control.

Two additional attacker-registered domains, sdhomeinspectors[.]com and southcarolinacounselor[.]com, disguised as innocuous small-business sites, receive the stolen seed phrases.

Russian-language code comments and developer markers throughout the toolkit tie MacSync to the broader AMOS/Atomic Stealer lineage, though researchers describe this as a family resemblance rather than confirmed attribution to a specific threat actor

Since file hashes and per-build identifiers change with every deployment, Huntress recommends anchoring detection on behavior rather than static indicators.

Organizations and individual users searching for AI tool installation guides should treat sponsored search results with heightened skepticism, verify Terminal commands before execution, and avoid pasting Base64-obfuscated commands regardless of the domain hosting the instructions.

About the Author

Harish Kumar

Author

Visit Website View All Posts