MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer
MacSync Stealer (TL-2026-1384), also tracked as ClaudeFix, is a high-severity malware campaign, first published 2026-07-15. It is attributed to MacSync operators (Russia) with low confidence, affects Apple macOS, maps to 33 MITRE ATT&CK techniques (T1005, T1016, T1020), and is covered by 9 detection rules and 18 indicators of compromise.
Key facts for TL-2026-1384
- Threat ID
- TL-2026-1384
- Also known as
- ClaudeFix, MacSync Stealer campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-07-15
- Last reviewed
- 2026-07-15
- Attribution
- MacSync operators
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, individuals-consumers, cryptocurrency
- Target regions
- Asia-Pacific, taiwan, Global
- Detection rules
- 9
- Indicators of compromise
- 18
Malware and tooling in MacSync Stealer
Malware and tooling: Amatera Stealer, Atomic Stealer, MacSync Stealer
A ClickFix social-engineering campaign tracked as 'ClaudeFix' (April-June 2026, with an acute wave June 12-19) abused paid Google Ads on searches like 'claude download' and 'claude mac' to redirect victims to weaponized claude.ai shared-chat links impersonating Apple Support. Victims were tricked into pasting a Base64-obfuscated curl/osascript command into Terminal, triggering a multi-stage, largely fileless AppleScript infection chain that deploys the MacSync Stealer to harvest Keychain data, browser credentials/cookies, SSH keys, cloud credentials (AWS, Kubernetes), Telegram data, and cryptocurrency wallets (Ledger/Trezor payloads, browser extensions) before self-deleting.
How MacSync Stealer works
Between roughly April 8 and June 19, 2026, at least two related but independently-infrastructured ClickFix campaigns impersonated Anthropic's Claude, OpenAI's ChatGPT/Codex/Atlas, Perplexity, Cursor IDE, and JetBrains to distribute the MacSync (also reported as 'MacSync Stealer') macOS infostealer. The campaign publicized as 'ClaudeFix' ran malicious Google Ads against search terms such as 'claude download', 'claude mac', 'claude ai', 'claude code' (plus Chinese-language variants), redirecting clickers to genuine claude.ai/share/ URLs whose shared-chat content had been crafted to impersonate an 'Apple Support' or developer-support conversation. The fake conversation instructs the victim to open Terminal and paste a Base64-encoded curl command as a purported 'fix' for a claimed installation problem -- a textbook ClickFix / T1204.004 lure that succeeds in part because the surrounding page is a legitimate, trust-anchored claude.ai domain, defeating URL-reputation and Safe Browsing—style checks.
Execution proceeds in stages: the pasted command silently (output redirected to /dev/null-equivalent) fetches a first-stage loader shell script (e.g. `loader.sh`) from attacker infrastructure disguised behind legitimate-appearing small-business domains (e.g. fake local roofing/flooring/pet-sitting sites). The loader is gzip-compressed and polymorphically/uniquely obfuscated per request to defeat signature-based detection, and executes substantially in memory. The loader in turn invokes `osascript` to run a dynamically-generated AppleScript payload -- the actual MacSync Stealer logic -- without ever dropping a conventional Mach-O binary or .app bundle to disk, complicating static analysis and EDR file-based detection.
Before harvesting data, one observed MacSync variant performs victim profiling / anti-analysis: it checks the system keyboard locale for Russian/CIS-region configurations and, if detected, exits silently while sending a `cis_blocked` telemetry ping to the C2 -- consistent with an Eastern-European / Russian-speaking operator (also suggested by Russian-language code comments) avoiding operations against victims in its home region. The stealer collects external IP, hostname, OS version, and keyboard locale for fingerprinting, then harvests macOS Keychain databases, credentials and session cookies from 12+ Chromium/Gecko-based browsers and 200+ browser extensions (including password managers), SSH private keys, AWS and Kubernetes configuration files, Telegram Desktop session data, documents matching sensitive extensions (.pdf, .wallet, .kdbx), and data from 16+ standalone cryptocurrency wallet applications (including Ledger/Trezor companion software) plus wallet browser extensions. Collected data is compressed and exfiltrated to attacker-controlled C2 in ~10MB chunks over HTTP(S); after exfiltration completes, the malware deletes its own artifacts and traces from the host to hinder incident response.
The wider campaign family (per Trend Micro, HackerNews/Sophos, and Malwarebytes reporting) spans six attack waves and 106+ unique malicious hostnames over about seven weeks, impersonating at least six AI/developer-tool brands (ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude Code, ChatGPT Atlas) in addition to plain 'Mac utility' scam lures, and also reused legitimate OpenAI ChatGPT shared-conversation links for the same trust-abuse pattern seen with claude.ai. Victim telemetry skews heavily toward Asia-Pacific (67.2% of confirmed traffic), with Taiwan alone responsible for 30.5% (772 confirmed interactions), suggesting deliberate regional ad targeting rather than opportunistic spray. The technique lineage traces to a broader 2025-2026 wave of macOS ClickFix campaigns (Atomic Stealer, Amatera Stealer via fake macOS utility/CAPTCHA lures) that prompted Apple to add native Terminal-paste security warnings in macOS Sequoia and Tahoe 26.4. The operators were previously known for distributing malware via fake 'cracked software' downloads before pivoting to ClickFix and AI-platform-abuse lures, and similar attacks have targeted ChatGPT/Grok users and Homebrew developers earlier in 2026.
MITRE ATT&CK techniques used in TL-2026-1384
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1614.001 System Language Discovery
Exfiltration
T1020 Automated Exfiltration; T1041 Exfiltration Over C2 Channel
Defense Evasion
T1027 Obfuscated Files or Information; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.001 Malicious Link; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Initial Access
T1189 Drive-by Compromise; T1566.002 Spearphishing Link
Credential Access
T1539 Steal Web Session Cookie; T1552.001 Credentials In Files; T1552.004 Private Keys; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Resource Development
T1583.001 Domains; T1584.001 Domains; T1587.001 Malware
Reconnaissance
T1589 Gather Victim Identity Information
Impact
defense-impairment
Affected products and versions in MacSync Stealer
- Apple — macOS
Vulnerable versions: macOS Sonoma; macOS Sequoia (pre-mitigation builds); macOS Ventura and earlier
Fixed in: macOS Sequoia (with Terminal-paste warning update); macOS Tahoe 26.4+
Remediation for MacSync Stealer
Patches
- Upgrade to macOS Sequoia or macOS Tahoe 26.4+, which introduce native Terminal security warnings when a user is about to paste a potentially malicious command
Immediate actions
- Block/monitor Terminal.app and osascript child-process launches from Finder/Spotlight/browser-initiated user sessions immediately following clipboard paste events
- Alert on curl/osascript invocations that pipe remote content directly into a shell or AppleScript interpreter (curl|sh / osascript equivalents) on macOS endpoints
- Search proxy/DNS logs for outbound connections to newly-registered small-business-themed domains serving /curl/, /debug/loader.sh, or similarly named paths
- Search for outbound access to claude.ai/share/ and other AI-vendor shared-chat/shared-conversation URLs immediately followed by Terminal.app foreground activity
- Rotate/revoke any AWS, Kubernetes, SSH, and cloud credentials present on macOS endpoints that show indicators of compromise
- Force Keychain and browser session/cookie invalidation on any confirmed-compromised Mac
Workarounds
- Disable/restrict AppleScript execution (osascript) via endpoint policy for standard users where not operationally required
- Navigate directly to claude.ai / chatgpt.com rather than clicking sponsored search results; obtain Claude Code CLI only via official Anthropic documentation
Longer-term hardening
- Deploy EDR clipboard-monitoring / ClickFix-pattern detection on macOS fleets
- User-awareness training specifically covering ClickFix: never paste unfamiliar Terminal commands regardless of the hosting site's legitimacy (including trusted domains like claude.ai, chatgpt.com)
- Restrict/monitor Google Ads brand-impersonation via continuous trademark/brand-monitoring on ad platforms
- Enforce macOS Gatekeeper/Notarization and consider limiting Terminal/osascript execution via MDM for non-developer user populations
- Establish detection coverage for AppleScript-based, largely fileless macOS stealers (behavioral, not signature-based)
Weaknesses (CWE) in MacSync Stealer
CWE-1021
Timeline of MacSync Stealer
- Related ClickFix macOS ClickFix campaigns (targeting Homebrew developers, fake macOS utilities) begin appearing in the wild, laying groundwork for later AI-brand impersonation waves.
- A MacSync variant introduces dynamic AppleScript payloads and in-memory execution specifically to evade static analysis and behavioral detection, per Sophos research.
- The Hacker News/Sophos publish reporting on ClickFix campaigns spreading the MacSync macOS infostealer via fake AI tool installer lures (ChatGPT Atlas, Claude Code).
- Broader six-wave malvertising campaign begins, impersonating six AI/developer brands (Claude, ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, ChatGPT Atlas) across 106+ unique malicious hostnames.
- The Register reports on macOS ClickFix attacks delivering AppleScript-based stealers, describing the fileless osascript execution chain.
- Microsoft Security publishes analysis of ClickFix campaigns using fake macOS utility lures to deliver infostealers.
- Security researchers identify abuse of claude.ai's shared-chat feature to host ClickFix social-engineering instructions impersonating Apple/developer support.
- Trend Micro and Cyber Security News publish detailed writeups on the claude.ai shared-chat abuse and the 'ClaudeFix' malvertising pattern, including malicious domain and shared-chat URL samples.
- The specifically-tracked 'ClaudeFix' campaign wave begins, running 22 distinct Google Ads campaign IDs targeting 'claude download'/'claude mac' search terms.
- The broader six-wave, 106-hostname malvertising campaign concludes after roughly seven weeks of activity, per Trend Micro telemetry.
- The acute 'ClaudeFix' campaign wave concludes; cumulative victim telemetry shows Asia-Pacific accounting for 67.2% of traffic, Taiwan alone 30.5% (772 confirmed interactions).
- Cyber Security News publishes the specific writeup on shared Claude chats being abused to deliver MacSync Stealer, prompting this threat's creation in the harness.
Sources cited for MacSync Stealer
- Shared Claude Chats Abused to Deliver MacSync Stealer
- macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware
- Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions
- Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
- Fake Claude search results lure Mac users into ClickFix attack
- Hackers abuse Google ads, Claude.ai chats to push Mac malware
- ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
- Claude Fraud - When Trusted Tools Become the Attack Surface: Weaponizing AI Developer Tooling Against the Security Community
- Malvertising Campaign Abuses Claude.ai Shared Chat Feature for Social Engineering Attacks
- macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware (Cryptika)
- macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers
- macOS ClickFix attacks deliver AppleScript stealers
- Evil evolution: ClickFix and macOS infostealers
Threats related to MacSync Stealer
- MacSync macOS Infostealer Delivered via Google Ads + Weaponized Claude.ai Shared Chats Impersonating Apple Support
- ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
- Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
- SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and Google-Masquerading LaunchAgent Backdoor
- ClickFix macOS Trio: Loader/Script/Helper Campaigns Deliver SHub Stealer, AMOS, and Macsync Stealer with Trojanized Ledger/Trezor/Exodus Wallets and GoogleUpdate-Masqueraded Persistence
- Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)
Detection coverage for TL-2026-1384
As of 2026-07-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1384 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.