Kiran 
A Google Ads malvertising campaign that weaponizes a genuine claude.ai page to distribute MacSync, a macOS infostealer capable of draining credentials, developer secrets, and cryptocurrency wallets without ever touching a lookalike domain or a fake login screen.
The campaign, detailed by researchers Rajesh TV, Vishal Panchani, and Rotimi Akinyele, targeted developers searching “how to install Claude Code on Mac.”
The sponsored result led to an authentic claude.ai/share page, not a spoofed clone, making it one of the more convincing installer lures analysts have documented this year.
Fake Claude Code Install Guide Delivers MacSync Malware
The attackers didn’t need to forge Anthropic’s infrastructure. They abused a legitimate feature Claude’s shareable conversation links to host a fake installation guide titled “Running Claude Code on Mac,” attributed to “Shared by Apple Support.”
Every visible signal checked out: real domain, real interface, familiar branding. Derivai confirmed the page was the actual ad destination by tracing Google Ads click-tracking parameters, including a specific gad_campaignid.
The core trick lived inside the installation command itself. Instead of a standard curl | bash chain, the malicious instruction used command substitution $(...) to decode a Base64 string at runtime, revealing the payload URL only after the shell had already resolved it.
Decoded, the command pointed to hybridcustomhomes[.]com, an aged domain with no connection to Anthropic. The command also included the -k flag, silently disabling certificate validation a detail invisible to anyone glancing at the plaintext instruction.
Derivai mapped the domain’s broader role, finding C2 beacon paths (/dynamic, /gate) alongside endpoints tied to Ledger Live trojanization and seed-phrase exfiltration.
The domain itself had been repurposed from a defunct small-business site, a pattern repeated across sibling domains like houstongaragedoorinstallers[.]com, suggesting a deliberate, repeatable acquisition playbook designed to pass casual reputation checks.
Indicators, including payload hashes and Cloudflare-fronted IPs, were corroborated against CrowdStrike Intelligence.
“This campaign isn’t a failure of technology it’s a failure of the heuristics we’ve trained developers to trust. ‘Check the domain’ and ‘read the command’ have been security gospel for a decade, but attackers just proved both checks can be satisfied while the attack still succeeds. Defense advice needs to evolve from ‘where is it hosted’ to ‘what does it actually resolve to.'”
MacSync targets macOS Keychain data, browser sessions, SSH keys, cloud credentials, npm/PyPI tokens, and over 80 cryptocurrency wallets, with reported exfiltration completing within seconds. Persistence is established via a LaunchAgent disguised as Google’s Keystone updater.
The Derivai stress that removing the malware isn’t sufficient if Ledger Live was trojanized; affected users must migrate funds to a wallet generated on a clean device entirely.
Mitigation
- Install Claude Code only via
claude.ai/install.shor the official npm package - Treat any command using Base64 decoding,
$(...)substitution,-k, or plain HTTP as a red flag - Avoid sponsored search results for developer tooling; navigate to vendor docs directly
- Deploy ad blockers on managed endpoints, per CISA/FBI guidance
- If compromised, reimage the device rather than attempting in-place cleanup, then rotate all credentials from a clean machine
About the Author
Potheeswaran 
