# MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer

> A ClickFix social-engineering campaign tracked as 'ClaudeFix' (April-June 2026, with an acute wave June 12-19) abused paid Google Ads on searches like 'claude download' and 'claude mac' to redirect victims to weaponized claude.ai shared-chat links impersonating Apple Support. Victims were tricked into pasting a Base64-obfuscated curl/osascript command into Terminal, triggering a multi-stage, largely fileless AppleScript infection chain that deploys the MacSync Stealer to harvest Keychain data, browser credentials/cookies, SSH keys, cloud credentials (AWS, Kubernetes), Telegram data, and cryptocurrency wallets (Ledger/Trezor payloads, browser extensions) before self-deleting.

- **Published:** 2026-07-15T00:00:00Z
- **Last reviewed:** 2026-10-22T09:43:20.000Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1384
- **ID:** TL-2026-1384
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 43 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Between roughly April 8 and June 19, 2026, at least two related but independently-infrastructured ClickFix campaigns impersonated Anthropic's Claude, OpenAI's ChatGPT/Codex/Atlas, Perplexity, Cursor IDE, and JetBrains to distribute the MacSync (also reported as 'MacSync Stealer') macOS infostealer. The campaign publicized as 'ClaudeFix' ran malicious Google Ads against search terms such as 'claude download', 'claude mac', 'claude ai', 'claude code' (plus Chinese-language variants), redirecting clickers to genuine claude.ai/share/ URLs whose shared-chat content had been crafted to impersonate an 'Apple Support' or developer-support conversation. The fake conversation instructs the victim to open Terminal and paste a Base64-encoded curl command as a purported 'fix' for a claimed installation problem -- a textbook ClickFix / T1204.004 lure that succeeds in part because the surrounding page is a legitimate, trust-anchored claude.ai domain, defeating URL-reputation and Safe Browsing—style checks.

Execution proceeds in stages: the pasted command silently (output redirected to /dev/null-equivalent) fetches a first-stage loader shell script (e.g. `loader.sh`) from attacker infrastructure disguised behind legitimate-appearing small-business domains (e.g. fake local roofing/flooring/pet-sitting sites). The loader is gzip-compressed and polymorphically/uniquely obfuscated per request to defeat signature-based detection, and executes substantially in memory. The loader in turn invokes `osascript` to run a dynamically-generated AppleScript payload -- the actual MacSync Stealer logic -- without ever dropping a conventional Mach-O binary or .app bundle to disk, complicating static analysis and EDR file-based detection.

Before harvesting data, one observed MacSync variant performs victim profiling / anti-analysis: it checks the system keyboard locale for Russian/CIS-region configurations and, if detected, exits silently while sending a `cis_blocked` telemetry ping to the C2 -- consistent with an Eastern-European / Russian-speaking operator (also suggested by Russian-language code comments) avoiding operations against victims in its home region. The stealer collects external IP, hostname, OS version, and keyboard locale for fingerprinting, then harvests macOS Keychain databases, credentials and session cookies from 12+ Chromium/Gecko-based browsers and 200+ browser extensions (including password managers), SSH private keys, AWS and Kubernetes configuration files, Telegram Desktop session data, documents matching sensitive extensions (.pdf, .wallet, .kdbx), and data from 16+ standalone cryptocurrency wallet applications (including Ledger/Trezor companion software) plus wallet browser extensions. Collected data is compressed and exfiltrated to attacker-controlled C2 in ~10MB chunks over HTTP(S); after exfiltration completes, the malware deletes its own artifacts and traces from the host to hinder incident response.

The wider campaign family (per Trend Micro, HackerNews/Sophos, and Malwarebytes reporting) spans six attack waves and 106+ unique malicious hostnames over about seven weeks, impersonating at least six AI/developer-tool brands (ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude Code, ChatGPT Atlas) in addition to plain 'Mac utility' scam lures, and also reused legitimate OpenAI ChatGPT shared-conversation links for the same trust-abuse pattern seen with claude.ai. Victim telemetry skews heavily toward Asia-Pacific (67.2% of confirmed traffic), with Taiwan alone responsible for 30.5% (772 confirmed interactions), suggesting deliberate regional ad targeting rather than opportunistic spray. The technique lineage traces to a broader 2025-2026 wave of macOS ClickFix campaigns (Atomic Stealer, Amatera Stealer via fake macOS utility/CAPTCHA lures) that prompted Apple to add native Terminal-paste security warnings in macOS Sequoia and Tahoe 26.4. The operators were previously known for distributing malware via fake 'cracked software' downloads before pivoting to ClickFix and AI-platform-abuse lures, and similar attacks have targeted ChatGPT/Grok users and Homebrew developers earlier in 2026.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1584.001 Domains
- T1587.001 Malware
- T1566.002 Spearphishing Link
- T1189 Drive-by Compromise
- T1204.001 Malicious Link
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1070.004 File Deletion
- T1685 Disable or Modify Tools
- T1497.001 System Checks
- T1082 System Information Discovery
- T1614.001 System Language Discovery
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1555.001 Keychain
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1552.004 Private Keys
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1074.001 Local Data Staging
- T1560 Archive Collected Data
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1020 Automated Exfiltration
- T1657 Financial Theft
- T1583.008 Acquire Infrastructure
- T1608.001 Stage Capabilities
- T1546.004 Event Triggered Execution
- T1056.002 Input Capture
- T1560.001 Archive Collected Data
- T1030 Data Transfer Size Limits

## Sources

- [Shared Claude Chats Abused to Deliver MacSync Stealer](https://cybersecuritynews.com/shared-claude-chats-macsync-stealer/)
- [macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware](https://cybersecuritynews.com/macos-malware-leverages-google-ads/)
- [Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions](https://cybersecuritynews.com/claude-ai-shared-chat-feature-abused/)
- [Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign](https://www.trendmicro.com/en_us/research/26/f/claudeai-shared-chat-abused-in-malvertising.html)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [Fake Claude search results lure Mac users into ClickFix attack](https://www.malwarebytes.com/blog/news/2026/05/fake-claude-search-results-lure-mac-users-into-clickfix-attack)
- [Hackers abuse Google ads, Claude.ai chats to push Mac malware](https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/)
- [ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories](https://thehackernews.com/2026/06/threatsday-bulletin-claude-chat-abuse.html)
- [Claude Fraud - When Trusted Tools Become the Attack Surface: Weaponizing AI Developer Tooling Against the Security Community](https://blog.7ai.com/claude-fraud-malware-campaign-ai-developer-tools)
- [Malvertising Campaign Abuses Claude.ai Shared Chat Feature for Social Engineering Attacks](https://cyberpress.org/malvertising-campaign-claude-ai-shared-chat-feature/)
- [macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware (Cryptika)](https://www.cryptika.com/macos-malware-leverages-google-ads-and-legitimate-claude-ai-shared-chats-to-deliver-malware/)
- [macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections](https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [macOS ClickFix attacks deliver AppleScript stealers](https://www.theregister.com/security/2026/04/21/macos-clickfix-attacks-deliver-applescript-stealers/5226728)
- [Evil evolution: ClickFix and macOS infostealers](https://www.sophos.com/en-us/blog/evil-evolution-clickfix-and-macos-infostealers)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1384