MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple Support

MacSync macOS Infostealer Delivered via Google Ads + (TL-2026-0491), also tracked as MacSync Claude.ai Lure, is a high-severity malware campaign, first published 2026-05-10. It has no confirmed attribution, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-0491

Threat ID
TL-2026-0491
Also known as
MacSync Claude.ai Lure, Claude Shared-Chat Apple Support Lure, MacSync 2026-Q2 Variant
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-05-10
Last reviewed
2026-05-10
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
consumer, developer, technology, creative, ai-engineering, designer-creative
Target regions
North America, Europe, Latin America, Asia-Pacific (non-CIS), Global excluding CIS / Russia
Detection rules
9
Indicators of compromise
22

Malware and tooling in MacSync macOS Infostealer Delivered via Google Ads +

Malware and tooling: MacSync, curl, gunzip, osascript

Active malvertising campaign abusing Google Ads pointing to legitimate Claude.ai shared chats that impersonate Apple Support and trick macOS users into pasting base64 Terminal commands. The first stage retrieves a gunzip-compressed in-memory shell loader that profiles the victim (CIS-region keyboard check, external IP, hostname, OS, locale) before delivering a fileless osascript second stage that exfiltrates browser credentials, cookies, and macOS Keychain contents. Two distinct operator infrastructures observed concurrently (Albayrak variant and BleepingComputer variant), confirming an active multi-operator MacSync campaign.

How MacSync macOS Infostealer Delivered via Google Ads + works

On 2026-05-10 BleepingComputer disclosed an active malvertising campaign that delivers a MacSync macOS infostealer variant by abusing two legitimate platforms in tandem: Google Ads and Claude.ai shared chats. Berk Albayrak, a security engineer at Trendyol Group, originally surfaced the technique on LinkedIn after observing sponsored Google search results for queries such as ''Claude mac download'' that linked to authentic claude.ai/share/<uuid> URLs. BleepingComputer subsequently identified a second variant operating on entirely separate infrastructure with identical social engineering structure, confirming multi-operator activity.

The lure: each weaponized Claude.ai shared chat is crafted to appear as a ''Claude Code on Mac'' installation guide attributed to ''Apple Support.'' Because the destination URL is the genuine claude.ai domain, classic malicious-domain heuristics (domain age, lookalike detection, certificate anomalies) are defeated. Users are instructed to open Terminal and paste a base64-encoded one-liner that decodes to a curl/bash chain pulling a shell loader from attacker infrastructure.

First stage — Albayrak variant: payload retrieved from https://customroofingcontractors[.]com/curl/ (filename component b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e); Albayrak''s exfiltration endpoint briskinternet[.]com was offline at the time of analysis. First stage — BleepingComputer variant: loader.sh (build=a39427f9d5bfda11277f1a58c89b7c2d) hosted at https://bernasibutuwqu2[.]com/debug/loader.sh. Both first stages are gunzip-compressed shell scripts evaluated entirely in memory, minimizing on-disk artifacts.

The BleepingComputer variant performs victim profiling before payload delivery: it enumerates input source (keyboard) locales, looks for Russian or CIS-region inputs, and on a positive match sends a quiet cis_blocked status ping and aborts. Only non-CIS hosts proceed. The loader collects external IP, hostname, OS version, and keyboard locale and posts them back to the operator before staging the second payload. The Albayrak variant skips this fingerprinting step entirely.

Second stage: a macOS osascript (AppleScript) command runs to perform credential harvesting without dropping a traditional binary, achieving fileless execution. Targets include Chromium-family browser Login Data and Cookies databases, Safari cookies, and the macOS Keychain (security find-generic-password / login keychain). Stolen artifacts are bundled and sent to attacker C2 over HTTP(S).

Reference samples on VirusTotal: ed5ed79a674972d1506dd8d68e8e13658125267ade86bfcb1ab794e2b49e50ac (Albayrak variant) and a833ad989b68dad582a1b591b8cf63466e79c850ff72916cf5d4c4a7f6bc650e (BleepingComputer variant). Public Claude.ai shared chat lure URLs include claude.ai/share/9aac1046-a39e-4618-8265-f54c4be863f7 and claude.ai/share/eb2db455-1d47-4baf-8671-0a689e165902.

This campaign is the first publicly documented weaponization of Claude.ai shared chats themselves. A precedent exists in late 2025 abuse of ChatGPT/Grok shared chats for similar copy-paste lures, and the technique pairs with a broader trend of malvertising on AI brand keywords (cf. TL-2026-0463 mshta+RedLine on Windows, TL-2026-0403 GitHub release Claude lures). Defenders should treat any sponsored result for AI-tool downloads as suspect, alert on Terminal paste of base64+curl pipelines, monitor osascript spawning under bash/zsh, and block the listed domains. No nation-state attribution; motive is financial credential theft.

MITRE ATT&CK techniques used in TL-2026-0491

Collection

T1005 Data from Local System

Discovery

T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1614.001 System Language Discovery

Defense Evasion

T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts; T1620 Reflective Code Loading

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.002 Command and Scripting Interpreter: AppleScript; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.001 User Execution: Malicious Link; T1204.004 User Execution: Malicious Copy and Paste

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1105 Ingress Tool Transfer

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Credential Access

T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Resource Development

T1583 Acquire Infrastructure; T1583.001 Acquire Infrastructure: Domains; T1583.008 Acquire Infrastructure: Malvertising; T1585.001 Establish Accounts: Social Media Accounts

Reconnaissance

T1592 Gather Victim Host Information

Affected products and versions in MacSync macOS Infostealer Delivered via Google Ads +

  • Apple — macOS
    Vulnerable versions: 12 Monterey; 13 Ventura; 14 Sonoma; 15 Sequoia
  • Google Chrome / Chromium browsers — Login Data / Cookies SQLite stores
    Vulnerable versions: all macOS builds
  • Apple — Safari Cookies
    Vulnerable versions: all
  • Apple — macOS Keychain (login.keychain-db)
    Vulnerable versions: all
  • Anthropic — Claude.ai shared chat feature
    Vulnerable versions: abused as content-hosting vector
  • Google — Google Ads
    Vulnerable versions: abused via sponsored results

Remediation for MacSync macOS Infostealer Delivered via Google Ads +

Immediate actions

  • Block the operator domains customroofingcontractors[.]com, bernasibutuwqu2[.]com, and briskinternet[.]com at DNS / proxy / firewall.
  • Take down or report the malicious Claude.ai shared chats (claude.ai/share/9aac1046-a39e-4618-8265-f54c4be863f7 and claude.ai/share/eb2db455-1d47-4baf-8671-0a689e165902) to Anthropic Trust & Safety.
  • Educate macOS users that no legitimate vendor (Apple, Anthropic) ever instructs pasting base64 Terminal commands.
  • Scan endpoints for executions of base64 -d | bash, curl|bash, or curl|gunzip|bash patterns from the last 30 days.
  • Force a password reset and revoke session cookies for any user who pasted Terminal commands from a Claude.ai shared chat.

Workarounds

  • Disable Google sponsored search results enterprise-wide via uBlock Origin or equivalent.
  • Configure macOS Keychain to require interactive approval for all keychain reads from non-Apple processes.
  • Block claude.ai/share/* URLs in environments that do not require Anthropic shared chat collaboration.

Longer-term hardening

  • Deploy macOS EDR with visibility into bash/zsh command lines and osascript spawning.
  • Restrict osascript execution from non-interactive shells via XProtect / endpoint policy where feasible.
  • Implement DNS allowlisting or policy-based blocking of newly registered domains and low-reputation TLDs.
  • Add a corporate browser policy blocking Google sponsored results for software-download queries; require download from vendor allowlist.
  • Introduce a paste-protection extension that warns when pasting shell-style commands into Terminal.

Weaknesses (CWE) in MacSync macOS Infostealer Delivered via Google Ads +

CWE-829, CWE-94, CWE-200

Timeline of MacSync macOS Infostealer Delivered via Google Ads +

  • Predecessor abuse of ChatGPT/Grok shared chats reported in late 2025; same copy-paste-into-Terminal social-engineering pattern but pre-dating the Claude.ai variant.
  • Earliest plausible campaign start window based on domain registration and Google Ads click-data referenced in Trendyol research (estimate).
  • Berk Albayrak (security engineer, Trendyol Group) discloses the Albayrak variant on LinkedIn after spotting a sponsored Google result for ''Claude mac download'' linking to a weaponized claude.ai/share/<uuid> chat.
  • BleepingComputer independently identifies a second variant operating on entirely separate infrastructure (bernasibutuwqu2[.]com) with identical lure structure but added CIS-region keyboard check.
  • Threadlinqs Intelligence publishes TL-2026-0491 with full IOC, MITRE, detection, and simulation coverage.
  • Albayrak variant''s exfiltration endpoint briskinternet[.]com observed offline at time of write-up; first-stage host customroofingcontractors[.]com still serving payload.
  • BleepingComputer publishes consolidated technical write-up with IOCs and VirusTotal hashes for both variants.
  • As of 2026-05-29, this MacSync macOS infostealer campaign remains ACTIVE: the Claude.ai shared-chat/Google Ads vector (disclosed 2026-05-10) drew no reported takedown by Anthropic or Google. MacSync itself is an evolving MaaS family with ~12 rotating C2 domains active Feb-May 2026, confirmed US SLTT-government victims, and no arrests or sinkholing.

Sources cited for MacSync macOS Infostealer Delivered via Google Ads +

Threats related to MacSync macOS Infostealer Delivered via Google Ads +

Detection coverage for TL-2026-0491

As of 2026-05-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0491 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats