# MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple Support

> Active malvertising campaign abusing Google Ads pointing to legitimate Claude.ai shared chats that impersonate Apple Support and trick macOS users into pasting base64 Terminal commands. The first stage retrieves a gunzip-compressed in-memory shell loader that profiles the victim (CIS-region keyboard check, external IP, hostname, OS, locale) before delivering a fileless osascript second stage that exfiltrates browser credentials, cookies, and macOS Keychain contents. Two distinct operator infrastructures observed concurrently (Albayrak variant and BleepingComputer variant), confirming an active multi-operator MacSync campaign.

- **Published:** 2026-05-10T12:00:00Z
- **Last reviewed:** 2026-05-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0491
- **ID:** TL-2026-0491
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-05-10 BleepingComputer disclosed an active malvertising campaign that delivers a MacSync macOS infostealer variant by abusing two legitimate platforms in tandem: Google Ads and Claude.ai shared chats. Berk Albayrak, a security engineer at Trendyol Group, originally surfaced the technique on LinkedIn after observing sponsored Google search results for queries such as ''Claude mac download'' that linked to authentic claude.ai/share/<uuid> URLs. BleepingComputer subsequently identified a second variant operating on entirely separate infrastructure with identical social engineering structure, confirming multi-operator activity.

The lure: each weaponized Claude.ai shared chat is crafted to appear as a ''Claude Code on Mac'' installation guide attributed to ''Apple Support.'' Because the destination URL is the genuine claude.ai domain, classic malicious-domain heuristics (domain age, lookalike detection, certificate anomalies) are defeated. Users are instructed to open Terminal and paste a base64-encoded one-liner that decodes to a curl/bash chain pulling a shell loader from attacker infrastructure.

First stage — Albayrak variant: payload retrieved from https://customroofingcontractors[.]com/curl/ (filename component b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e); Albayrak''s exfiltration endpoint briskinternet[.]com was offline at the time of analysis. First stage — BleepingComputer variant: loader.sh (build=a39427f9d5bfda11277f1a58c89b7c2d) hosted at https://bernasibutuwqu2[.]com/debug/loader.sh. Both first stages are gunzip-compressed shell scripts evaluated entirely in memory, minimizing on-disk artifacts.

The BleepingComputer variant performs victim profiling before payload delivery: it enumerates input source (keyboard) locales, looks for Russian or CIS-region inputs, and on a positive match sends a quiet cis_blocked status ping and aborts. Only non-CIS hosts proceed. The loader collects external IP, hostname, OS version, and keyboard locale and posts them back to the operator before staging the second payload. The Albayrak variant skips this fingerprinting step entirely.

Second stage: a macOS osascript (AppleScript) command runs to perform credential harvesting without dropping a traditional binary, achieving fileless execution. Targets include Chromium-family browser Login Data and Cookies databases, Safari cookies, and the macOS Keychain (security find-generic-password / login keychain). Stolen artifacts are bundled and sent to attacker C2 over HTTP(S).

Reference samples on VirusTotal: ed5ed79a674972d1506dd8d68e8e13658125267ade86bfcb1ab794e2b49e50ac (Albayrak variant) and a833ad989b68dad582a1b591b8cf63466e79c850ff72916cf5d4c4a7f6bc650e (BleepingComputer variant). Public Claude.ai shared chat lure URLs include claude.ai/share/9aac1046-a39e-4618-8265-f54c4be863f7 and claude.ai/share/eb2db455-1d47-4baf-8671-0a689e165902.

This campaign is the first publicly documented weaponization of Claude.ai shared chats themselves. A precedent exists in late 2025 abuse of ChatGPT/Grok shared chats for similar copy-paste lures, and the technique pairs with a broader trend of malvertising on AI brand keywords (cf. TL-2026-0463 mshta+RedLine on Windows, TL-2026-0403 GitHub release Claude lures). Defenders should treat any sponsored result for AI-tool downloads as suspect, alert on Terminal paste of base64+curl pipelines, monitor osascript spawning under bash/zsh, and block the listed domains. No nation-state attribution; motive is financial credential theft.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1583.008 Acquire Infrastructure: Malvertising
- T1585.001 Establish Accounts: Social Media Accounts
- T1592 Gather Victim Host Information
- T1189 Drive-by Compromise
- T1566 Phishing
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.002 Command and Scripting Interpreter: AppleScript
- T1204.001 User Execution: Malicious Link
- T1204.004 User Execution: Malicious Copy and Paste
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1564 Hide Artifacts
- T1614.001 System Language Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1555.001 Credentials from Password Stores: Keychain
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1071.001 Application Layer Protocol: Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Hackers abuse Google ads, Claude.ai chats to push Mac malware](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/)
- [Berk Albayrak — initial LinkedIn disclosure (Trendyol Group security engineering)](https://www.linkedin.com/in/berkalbayrak/)
- [VirusTotal — Albayrak variant payload](https://www.virustotal.com/gui/file/ed5ed79a674972d1506dd8d68e8e13658125267ade86bfcb1ab794e2b49e50ac)
- [VirusTotal — BleepingComputer variant payload](https://www.virustotal.com/gui/file/a833ad989b68dad582a1b591b8cf63466e79c850ff72916cf5d4c4a7f6bc650e)
- [Anthropic Trust & Safety — Reporting abusive shared chats](https://support.anthropic.com/en/articles/8088480-trust-and-safety-reporting)
- [MITRE ATT&CK — T1204.004 User Execution: Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK — T1059.002 AppleScript](https://attack.mitre.org/techniques/T1059/002/)
- [MITRE ATT&CK — T1555.001 Credentials from Password Stores: Keychain](https://attack.mitre.org/techniques/T1555/001/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0491