MacSync Stealer v1.1.2 ("claude1"): Malicious Google Ad Impersonates Claude Code Installer to Hijack macOS Systems

MacSync Stealer v1.1.2 ("claude1") (TL-2026-1042), also tracked as claude1 campaign, is a high-severity malware campaign, first published 2026-07-01. It has no confirmed attribution, affects Apple macOS (all versions with Gatekeeper/code-signing), maps to 28 MITRE ATT&CK techniques (T1005, T1020, T1027), and is covered by 9 detection rules and 19 indicators of compromise.

Key facts for TL-2026-1042

Threat ID
TL-2026-1042
Also known as
claude1 campaign, Fake Claude Code Installer Campaign
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-01
Last reviewed
2026-07-01
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
technology, software development, cryptocurrency, general consumer
Target regions
North America, Europe, Global
Detection rules
9
Indicators of compromise
19

Malware and tooling in MacSync Stealer v1.1.2 ("claude1")

Malware and tooling: MacSync Stealer, MacSync Stealer (related campaign C2: securityfenceandwelding[.]com), MacSync Stealer v1.1.2, Caronte platform

A sponsored Google ad ranking above legitimate results for "claude code mac install" redirects victims to a fake Google Sites page mimicking Anthropic branding, which instructs users to paste a base64-encoded three-stage zsh dropper into Terminal. The resulting payload, MacSync Stealer v1.1.2 (build tag "claude1"), harvests browser/crypto-wallet/SSH/cloud credentials and trojans the Ledger Live Electron app to phish seed phrases on next launch.

How MacSync Stealer v1.1.2 ("claude1") works

On 2026-07-01, Beelzebub Labs (via its Caronte threat-intelligence platform) disclosed a ClickFix-style malvertising campaign impersonating the Claude Code CLI installer for macOS. Victims searching "claude code mac install" on Google are served a sponsored ad ranking above Anthropic's legitimate documentation; clicking it leads to a fake install page hosted on the trusted sites.google.com domain, spoofing Anthropic branding and install instructions. The page instructs the victim to copy and paste a single Terminal command containing a base64- and gzip-encoded, randomized-variable-name zsh dropper. On execution, the dropper silently redirects output, fetches and stages the payload in a curl-and-execute chain, and displays a spoofed macOS System Preferences-style password dialog to socially engineer the victim into entering their local account password, which is then used to unlock the macOS Keychain and other OS-protected secret stores that a browser-only stealer could not otherwise reach. The delivered payload is MacSync Stealer v1.1.2, tagged internally with the build string "claude1", identifying this as a distinct, purpose-built campaign variant of the broader MacSync Stealer malware-as-a-service (MaaS) family that has previously been distributed via ClickFix lures impersonating ChatGPT Atlas, Mac cleanup utilities, and code-signed Swift installers since at least November 2025. Once credentials are harvested, MacSync Stealer enumerates and exfiltrates saved passwords from 14+ Chromium-based browsers and Firefox/Gecko variants, targets 80+ browser-based cryptocurrency wallet extensions and 20+ desktop wallet applications, and collects SSH private keys, AWS and Kubernetes configuration files, Telegram Desktop session data, Safari browsing history, Apple Notes content, and general Desktop/Documents/Downloads files matching sensitive patterns (PDFs, configs, key material). Harvested data is packaged into an archive and uploaded to attacker infrastructure in unencrypted 10-megabyte chunks; a design flaw causes the archive to become corrupted and unreadable to the attacker if the upload is interrupted, and the malware additionally blocks itself with a fake error dialog that pauses execution entirely until the victim clicks through it, giving defenders and victims a brief window to abort exfiltration via force-quit, lid-close, or restart before the dialog is dismissed. Beyond credential theft, MacSync Stealer performs a persistent hijack of installed Ledger hardware-wallet software: it downloads a modified version of the Ledger Live Electron application, swaps it in place of the legitimate binary, and re-signs the trojanized bundle to bypass macOS Gatekeeper/code-signing integrity checks. The trojanized build contains an injected instruction (annotated with a Russian-language code comment, suggesting Russian-speaking operators or reused Russian-authored tooling) that, after a 5-second delay on next launch, triggers a spoofed "wallet recovery" flow designed to phish the victim's hardware-wallet seed phrase directly into attacker hands — a much higher-value, longer-persistence compromise than a one-time credential dump. Files staged by the dropper use a `.daily` extension and hash-derived filenames, consistent with the operator rotating payloads on (at minimum) a daily cadence to evade static-hash-based detection and takedown. Google removed the malicious ad within 24 hours of notification for policy violation, but Beelzebub Labs and other researchers (Gridinsoft, 7AI, Jamf Threat Labs, CloudSEK, Microsoft, SANS ISC, The Hacker News) have tracked the broader MacSync Stealer ClickFix family rotating lure brands (ChatGPT, Homebrew, Claude Code), lure domains, and payload stages continuously since Q4 2025, indicating an active, evolving MaaS operation rather than a single-use campaign. No CVE applies; this is a pure social-engineering/malvertising delivery chain rather than an exploited software vulnerability.

MITRE ATT&CK techniques used in TL-2026-1042

Collection

T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data

Exfiltration

T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information

Credential Access

T1056 Input Capture; T1552 Unsecured Credentials; T1555 Credentials from Password Stores; T1606 Forge Web Credentials

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1083 File and Directory Discovery; T1518 Software Discovery

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Impact

T1531 Account Access Removal; T1657 Financial Theft

defense-impairment

T1553 Subvert Trust Controls; T1685 Disable or Modify Tools

Persistence

T1554 Compromise Host Software Binary

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1586 Compromise Accounts

Affected products and versions in MacSync Stealer v1.1.2 ("claude1")

  • Apple — macOS (all versions with Gatekeeper/code-signing)
    Vulnerable versions: all current macOS releases as of 2026-07
  • Ledger — Ledger Live (Electron desktop app, macOS)
    Vulnerable versions: installed versions prior to trojan replacement
  • Google — Google Ads / Google Sites (abused as distribution infrastructure, not itself vulnerable)

Remediation for MacSync Stealer v1.1.2 ("claude1")

Immediate actions

  • Never paste or execute Terminal commands copied from a webpage, especially install instructions found via sponsored/ad search results
  • Verify Claude Code / Anthropic CLI installation instructions only via the official docs at docs.claude.com or the anthropics GitHub org, never via sites.google.com or ad-served links
  • If the dropper command was already executed, immediately rotate all browser-saved passwords, SSH keys, cloud (AWS/Kubernetes) credentials, and any credentials stored in Keychain
  • Treat any Ledger/hardware wallet used on the affected Mac as compromised: do not enter the recovery/seed phrase into any on-screen prompt, verify the Ledger Live app's code signature and reinstall from the official Ledger source, and if a recovery prompt appeared, migrate funds to a new wallet generated on a clean, verified device
  • Report ads impersonating Anthropic/Claude Code to Google Ads abuse and to Anthropic security

Workarounds

  • Search for Claude Code install docs directly on anthropic.com/claude.com rather than clicking sponsored search results
  • Use a password manager rather than manually typing the macOS account password into any dialog triggered by a downloaded/pasted script

Longer-term hardening

  • Deploy EDR/behavioral monitoring on macOS fleets for Terminal-initiated curl/base64/gzip decode chains and AppleScript-driven fake system dialogs
  • Block or alert on outbound uploads in fixed-size (~10MB) unencrypted chunks to newly-registered or reputation-poor domains
  • User awareness training specifically covering ClickFix / "paste this command to install" social engineering
  • Enforce application allowlisting / Gatekeeper notarization verification for high-value apps such as Ledger Live, and alert on unexpected re-signing or binary replacement of installed wallet software
  • Monitor for MacSync Stealer's broader MaaS infrastructure (rotating lure domains, code-signing certificates) via threat-intel feeds

Weaknesses (CWE) in MacSync Stealer v1.1.2 ("claude1")

CWE-451, CWE-494, CWE-1021

Timeline of MacSync Stealer v1.1.2 ("claude1")

  • MacSync Stealer MaaS family first tracked distributing via ChatGPT Atlas browser-lure malvertising on Google Ads.
  • MacSync Stealer variant observed using a code-signed installer to bypass Apple Gatekeeper, distributed via fake Mac storage-cleanup search redirects.
  • SANS Internet Storm Center publishes diary on a malicious Homebrew-themed ad leading to MacSync Stealer.
  • Jamf Threat Labs documents MacSync Stealer evolving to a code-signed Swift binary with dynamic AppleScript payloads and in-memory execution to evade static analysis.
  • The Hacker News reports on ClickFix campaigns spreading MacSync via fake AI tool installers (ChatGPT, Claude Code) across Belgium, India, and the Americas.
  • CloudSEK documents a MacSync Stealer wave using SEO poisoning and fake GitHub repositories to broaden the delivery surface.
  • Microsoft Security Blog publishes on ClickFix campaigns using fake macOS utility lures to deliver infostealers, corroborating the MacSync family's continued activity.
  • The Hacker News ThreatsDay bulletin references ongoing Claude-branded chat/tooling abuse alongside other developer-ecosystem threats.
  • Cyber Security News, Gridinsoft, and 7AI publish independent write-ups of the Claude Code-impersonation campaign and its technical mechanics.
  • Google removes the malicious sponsored ad within 24 hours of the campaign's discovery, citing policy violation.
  • Beelzebub Labs, via the Caronte platform, discovers and discloses the Claude Code-impersonating sponsored Google ad delivering MacSync Stealer v1.1.2 (build tag "claude1").

Sources cited for MacSync Stealer v1.1.2 ("claude1")

Threats related to MacSync Stealer v1.1.2 ("claude1")

Detection coverage for TL-2026-1042

As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1042 across Splunk SPL, Microsoft KQL and Sigma, covering 19 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats