# MacSync Stealer v1.1.2 ("claude1"): Malicious Google Ad Impersonates Claude Code Installer to Hijack macOS Systems

> A sponsored Google ad ranking above legitimate results for "claude code mac install" redirects victims to a fake Google Sites page mimicking Anthropic branding, which instructs users to paste a base64-encoded three-stage zsh dropper into Terminal. The resulting payload, MacSync Stealer v1.1.2 (build tag "claude1"), harvests browser/crypto-wallet/SSH/cloud credentials and trojans the Ledger Live Electron app to phish seed phrases on next launch.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1042
- **ID:** TL-2026-1042
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 19 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-01, Beelzebub Labs (via its Caronte threat-intelligence platform) disclosed a ClickFix-style malvertising campaign impersonating the Claude Code CLI installer for macOS. Victims searching "claude code mac install" on Google are served a sponsored ad ranking above Anthropic's legitimate documentation; clicking it leads to a fake install page hosted on the trusted sites.google.com domain, spoofing Anthropic branding and install instructions. The page instructs the victim to copy and paste a single Terminal command containing a base64- and gzip-encoded, randomized-variable-name zsh dropper. On execution, the dropper silently redirects output, fetches and stages the payload in a curl-and-execute chain, and displays a spoofed macOS System Preferences-style password dialog to socially engineer the victim into entering their local account password, which is then used to unlock the macOS Keychain and other OS-protected secret stores that a browser-only stealer could not otherwise reach. The delivered payload is MacSync Stealer v1.1.2, tagged internally with the build string "claude1", identifying this as a distinct, purpose-built campaign variant of the broader MacSync Stealer malware-as-a-service (MaaS) family that has previously been distributed via ClickFix lures impersonating ChatGPT Atlas, Mac cleanup utilities, and code-signed Swift installers since at least November 2025. Once credentials are harvested, MacSync Stealer enumerates and exfiltrates saved passwords from 14+ Chromium-based browsers and Firefox/Gecko variants, targets 80+ browser-based cryptocurrency wallet extensions and 20+ desktop wallet applications, and collects SSH private keys, AWS and Kubernetes configuration files, Telegram Desktop session data, Safari browsing history, Apple Notes content, and general Desktop/Documents/Downloads files matching sensitive patterns (PDFs, configs, key material). Harvested data is packaged into an archive and uploaded to attacker infrastructure in unencrypted 10-megabyte chunks; a design flaw causes the archive to become corrupted and unreadable to the attacker if the upload is interrupted, and the malware additionally blocks itself with a fake error dialog that pauses execution entirely until the victim clicks through it, giving defenders and victims a brief window to abort exfiltration via force-quit, lid-close, or restart before the dialog is dismissed. Beyond credential theft, MacSync Stealer performs a persistent hijack of installed Ledger hardware-wallet software: it downloads a modified version of the Ledger Live Electron application, swaps it in place of the legitimate binary, and re-signs the trojanized bundle to bypass macOS Gatekeeper/code-signing integrity checks. The trojanized build contains an injected instruction (annotated with a Russian-language code comment, suggesting Russian-speaking operators or reused Russian-authored tooling) that, after a 5-second delay on next launch, triggers a spoofed "wallet recovery" flow designed to phish the victim's hardware-wallet seed phrase directly into attacker hands — a much higher-value, longer-persistence compromise than a one-time credential dump. Files staged by the dropper use a `.daily` extension and hash-derived filenames, consistent with the operator rotating payloads on (at minimum) a daily cadence to evade static-hash-based detection and takedown. Google removed the malicious ad within 24 hours of notification for policy violation, but Beelzebub Labs and other researchers (Gridinsoft, 7AI, Jamf Threat Labs, CloudSEK, Microsoft, SANS ISC, The Hacker News) have tracked the broader MacSync Stealer ClickFix family rotating lure brands (ChatGPT, Homebrew, Claude Code), lure domains, and payload stages continuously since Q4 2025, indicating an active, evolving MaaS operation rather than a single-use campaign. No CVE applies; this is a pure social-engineering/malvertising delivery chain rather than an exploited software vulnerability.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1585 Establish Accounts
- T1189 Drive-by Compromise
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1606 Forge Web Credentials
- T1083 File and Directory Discovery
- T1518 Software Discovery
- T1005 Data from Local System
- T1074 Data Staged
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1531 Account Access Removal
- T1657 Financial Theft
- T1554 Compromise Host Software Binary

## Sources

- [A Weaponized Google Ad Install Malicious Claude Code to Hijack Entire macOS](https://cybersecuritynews.com/a-weaponized-google-ad-install-malicious-claude-code-to-hijack-entire-macos/)
- [Fake Claude Code Ads Push MacSync Stealer on macOS](https://blog.gridinsoft.com/fake-claude-code-macsync-stealer-google-ads/)
- [Claude Fraud - When Trusted Tools Become the Attack Surface: Weaponizing AI Developer Tooling Against the Security Community](https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools)
- [MacSync Stealer Evolves: From ClickFix to Code-Signed Swift Malware](https://www.jamf.com/blog/macsync-stealer-evolution-code-signed-swift-malware-analysis/)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [Claude LLM artifacts abused to push Mac infostealers in ClickFix attack](https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/)
- [MacSync infostealer deployed via Claude AI artifact, Google Ads exploitation](https://www.scworld.com/brief/macsync-infostealer-deployed-via-claude-ai-google-ads-exploitation)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [MacSync Stealer: SEO Poisoning and ClickFix-Based macOS Malware Delivery Chain](https://www.cloudsek.com/blog/macsync-stealer-seo-poisoning-and-clickfix-based-macos-malware-delivery-chain)
- [Malicious Ad for Homebrew Leads to MacSync Stealer](https://isc.sans.edu/diary/32942)
- [ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories](https://thehackernews.com/2026/06/threatsday-bulletin-claude-chat-abuse.html)
- [New MacSync macOS Stealer Uses Signed App to Bypass Apple Gatekeeper](https://thehackernews.com/2025/12/new-macsync-macos-stealer-uses-signed.html)
- [MacSync Stealer malware bypasses macOS Gatekeeper security warnings](https://www.csoonline.com/article/4111179/macsync-stealer-malware-bypasses-macos-gatekeeper-security-warnings.html)
- [MacSync Stealer Campaign Impacting U.S. SLTT macOS Users](https://www.cisecurity.org/insights/blog/macsync-stealer-campaign-impacting-us-sltt-macos-users)
- [MacSync Stealer: How a MaaS Infostealer Is Quietly Draining macOS Endpoints](https://redpiranha.net/news/macsync-stealer-how-maas-infostealer-quietly-draining-macos-endpoints)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1042