# MacSync Stealer: Malvertising Campaign Impersonates Claude/Apple Support to Deploy macOS Infostealer

> A malvertising campaign poisons Google search results for "How to Install Claude on a Mac," directing victims to a fake Claude.ai shared conversation impersonating Apple Support. A ClickFix-style lure tricks victims into pasting a curl command into Terminal, triggering a polymorphic zsh loader that chains through six stages to deploy MacSync Stealer, a native universal Mach-O RAT that harvests browser cookies/logins, Keychain secrets, Telegram sessions, SSH/cloud keys, and cryptocurrency wallet data while gaining Full Disk Access, Screen Recording (TCC) access, and persistent remote command execution via a LaunchAgent.

- **Published:** 2026-08-17T00:00:00Z
- **Last reviewed:** 2026-08-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2061
- **ID:** TL-2026-2061
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MacSync Stealer is a macOS infostealer/RAT family, first publicly named around March 2026, that has been distributed through a series of ClickFix (malicious copy-and-paste) malvertising waves abusing the chat-sharing features of popular AI assistants as free, trusted-domain phishing infrastructure. Earlier waves (November 2025-February 2026) abused OpenAI's ChatGPT Atlas branding and fake Google Sites/GitHub-themed landing pages; a June 2026 wave tracked by Zscaler as "ClaudeFix" abused shared Claude.ai chat pages directly and carried Russian-language developer comments in its AppleScript payload. The wave documented here (Huntress, published 2026-08-17) poisons Google's sponsored results for "How to Install Claude on a Mac" and lands victims on a claude.ai/share conversation cosmetically dressed as joint Apple/Anthropic install instructions from a fake "Apple Support" persona.

The kill chain runs six stages. Stage 1 is a 1,442-byte polymorphic zsh wrapper (per-victim token, so the hash changes on every build) that unpacks a Base64+gzip heredoc payload. Stage 2 (`daemon_function`) runs entirely in memory, fetching Stage 3, staging exfiltrated data at /tmp/osalogging.zip, and cleaning up staging files. Stage 3 is server-side-generated AppleScript, unique per victim, that social-engineers a Full Disk Access TCC grant, extracts the Chromium "Safe Storage" AES key from the login Keychain, and harvests cookies/logins/web data from 13 Chromium-based and Gecko-based browsers plus Telegram Desktop sessions, SSH keys, AWS/Kubernetes credentials, and Keychain databases. Stage 4 installs the MacSync Stealer Mach-O RAT itself (universal x86_64+arm64, ad-hoc signed, statically linked against OpenSSL 3.6.2/Brotli) with LaunchAgent persistence disguised as a system updater (e.g. Google Keystone, Adobe ARM, Microsoft AutoUpdate), giving the operator a full interactive shell, arbitrary command execution, and file upload/download over an AES-256-CBC-encrypted WebSocket/TLS channel to a hardcoded IP with an XOR(0xAA)-obfuscated domain fallback. Stage 5 is a separately signed helper that harvests a second TCC grant (Screen Recording) via CGRequestScreenCaptureAccess and exfiltrates screenshots through the Stage 4 RAT channel. Stage 6 rewrites 60 browser wallet extensions, 21 desktop wallet apps, and 3 hardware-wallet companion apps (Ledger Wallet, Ledger Live, Trezor Suite confirmed) in place, injecting phishing UI that captures recovery/seed phrases and exfiltrates them as JSON to attacker infrastructure.

Attribution is unresolved and contested across sources: Zscaler's independent technical analysis of a related June 2026 "ClaudeFix" wave found Russian-language developer comments embedded in the AppleScript payload and assessed the operators as likely Russian-speaking and financially motivated; secondary aggregators (The Hacker News, IT Security News) have separately attributed fake-Claude-installer malvertising to DPRK-linked actors and the "Contagious Interview" cluster, but Huntress's own MacSync writeups do not make a DPRK attribution, and it is explicitly unclear whether all the ClickFix/fake-AI-installer waves (ChatGPT Atlas lure, GitHub-themed lure, ClaudeFix, this Apple Support lure) are run by the same actor. The financially-motivated, crypto-wallet-draining payload is consistent across all observed waves regardless of attribution.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1548 Abuse Elevation Control Mechanism
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1560 Archive Collected Data
- T1113 Screen Capture
- T1543 Create or Modify System Process
- T1554 Compromise Host Software Binary
- T1573 Encrypted Channel
- T1657 Financial Theft

## Sources

- [MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer](https://www.huntress.com/blog/fake-claude-macsync)
- [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://www.huntress.com/blog/macsync-stealer-rat-reverse-engineering)
- [ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers](https://thehackernews.com/2026/03/clickfix-campaigns-spread-macsync-macos.html)
- [ClaudeFix: Shared Claude Chats Meet ClickFix](https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix)
- [MacSync Stealer RAT Uses Fake Claude Guides to Steal Passwords and Crypto Wallets](https://gbhackers.com/macsync-stealer-rat-uses-fake-claude-guides/)
- [MacSync macOS Stealer Uses Fake Claude Guide to Steal Passwords and Crypto Wallets](https://cybersecuritynews.com/macsync-uses-fake-claude-guide/)
- [Claude LLM artifacts abused to push Mac infostealers in ClickFix attack](https://www.bleepingcomputer.com/news/security/claude-llm-artifacts-abused-to-push-mac-infostealers-in-clickfix-attack/)
- [Fake Claude app promoted by Bing ads pushes SectopRAT malware](https://www.bleepingcomputer.com/news/security/fake-claude-app-promoted-by-bing-ads-pushes-sectoprat-malware/)
- [Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT](https://www.huntress.com/blog/fakeagent-claude-desktop-malvertising-ends-in-dotnet-rat)
- [DPRK-linked macOS malvertising uses fake updates to deliver crypto-stealing malware (aggregation of DPRK-attribution reporting)](https://ground.news/article/dprk-linked-macos-malvertising-uses-fake-updates-to-deliver-crypto-stealing-malware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2061