Threat reportMalwareTL-2026-4511
ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts and Google Ads to Deliver AMOS Stealer and Windows .NET RAT
ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts (TL-2026-4511) is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Apple macOS (end users running pasted Terminal commands), maps to 24 MITRE ATT&CK techniques (T1005, T1010, T1027), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4511
- Threat ID
- TL-2026-4511
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, general consumers, software development
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts
Malware and tooling: .NET RAT (obfuscated), AMOS, Exodus - S0405, Trojanized Ledger Live, Trojanized Ledger Wallet, Trojanized Trezor Suite, Google Ads
How ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts works
Cybercriminals hosted malicious content as user-generated Shared Chats and Artifacts on claude.ai and promoted them via paid Google Ads. Victims were given ClickFix instructions to paste obfuscated commands into Terminal (macOS) or PowerShell (Windows), delivering Atomic macOS Stealer (AMOS), an obfuscated .NET remote-access executable, and trojanized Ledger Live, Ledger Wallet and Trezor Suite apps that harvest recovery phrases.
Gen Digital researcher Vojtech Moravec reported (2026-10-26) an active, apparently funded malvertising operation that abuses the legitimate claude.ai domain. Attackers publish user-generated Shared Chats (claude.ai/share/...) and public Artifacts (claude.ai/artifact/...) that impersonate Claude download/installation guides, then buy Google Ads so that searches for Claude downloads surface these pages under a trusted domain. Ad click-through URLs carried the gclid and gad_campaignid parameters, and Gen observed multiple rotating Artifacts across two separate ad campaigns (screenshots dated 2026-10-16 to 2026-10-23), indicating a sustained operation rather than a one-off case.
The macOS branch presents a fake 'Download Claude' page via an Artifact with an 'Install on macOS' dialog and uses the ClickFix technique: the victim copies a command, pastes it into Terminal and presses Enter. The command is scrambled so the visitor sees only gibberish; because the user runs it themselves, nothing suspicious is 'downloaded' from a detection standpoint. The chain is a loader script fetched from an attacker server, a second-stage unpacker script, then an AppleScript-based Atomic macOS Stealer (AMOS) payload. AMOS collects passwords and session cookies from Chromium- and Gecko-based browsers, decrypts Keychain data, steals cryptocurrency wallet data (browser extensions and desktop apps: Electrum, Exodus, Ethereum, Bitcoin, Ledger, Trezor), and searches for files with the extensions .pdf, .docx, .key, .seed, .pem, .wallet and .ovpn. When the process lacks Full Disk Access, fake system dialogs are used to socially engineer the user and shell startup files are modified. Collected data is compressed into a ZIP, uploaded to the attacker server, and temporary files are cleaned up. A later stage replaces installed Ledger Live/Ledger Wallet and Trezor Suite applications with trojanized versions that prompt the user for a wallet recovery phrase, which is sent to a second attacker server.
The Windows branch uses an 'Install Claude on Windows' Artifact that instructs the victim to press Win+R, paste (Ctrl+V) and press Enter, running an obfuscated PowerShell command that prints fake progress messages ('Challenge in progress... 50% done... 70% done'). It retrieves, via GitHub and github.io pages, an encrypted, heavily obfuscated .NET executable with remote-access capability. Gen reports code injection into legitimate Windows processes, antivirus-detection checks, desktop screenshot capture, window-title logging, wallet targeting (Electrum, Exodus, Ethereum, Bitcoin, Ledger) and a persistent command channel to attacker servers. The source does not disclose IP addresses, C2 domain names or file hashes, so the IOC set is limited to abused platform URL patterns, staging infrastructure class, ad-tracking parameters, malware/tool names and behavioral indicators. Separate Claude-themed ClickFix campaigns delivering MacSync stealer (Zscaler 'ClaudeFix'; Trend Micro, active 2026-04-08 to 2026-06-14, GitLab Pages hosts and 45+ weaponized shared chat IDs) use different infrastructure and are cited as related context only, not as confirmed same-actor activity.
MITRE ATT&CK techniques used in TL-2026-4511
Collection
T1005 Data from Local System; T1113 Screen Capture; T1560 Archive Collected Data
Discovery
T1010 Application Window Discovery; T1518.001 Software Discovery: Security Software Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1055 Process Injection; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation
Credential Access
T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.001 PowerShell; T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Command and Control
Persistence
T1546.004 Unix Shell Configuration Modification; T1554 Compromise Host Software Binary
Resource Development
T1583.008 Malvertising; T1608 Stage Capabilities
Impact
Affected products and versions in ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts
- Apple — macOS (end users running pasted Terminal commands)
Vulnerable versions: User-execution social engineering; no specific version stated - Microsoft — Windows (end users running pasted PowerShell commands)
Vulnerable versions: User-execution social engineering; no specific version stated - Ledger — Ledger Live / Ledger Wallet (desktop app replaced with trojanized version)
Vulnerable versions: Installed desktop apps on macOS hosts infected with AMOS - Trezor — Trezor Suite (desktop app replaced with trojanized version)
Vulnerable versions: Installed desktop apps on macOS hosts infected with AMOS - Anthropic — claude.ai Shared Chats and Artifacts (abused as hosting; not a product vulnerability)
Remediation for ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts
Immediate actions
- Alert users that Claude is installed only from the official claude.com/download page, never from search ads or shared chats/artifacts
- Block or alert on proxy/DNS traffic to claude.ai/share/ and claude.ai/artifact/ URLs arriving with gclid or gad_campaignid parameters from search-ad referrals
- Hunt for Terminal/zsh/bash processes spawning curl, base64 decode or osascript chains, and PowerShell launched from the Run dialog (explorer.exe parent) with encoded or downloaded content
- Hunt for unexpected modifications to shell startup files (.zshrc, .zprofile, .bash_profile) and ZIP archives created then uploaded from macOS hosts
- Re-verify installed Ledger Live, Ledger Wallet and Trezor Suite apps against vendor-signed downloads; any app asking for a recovery phrase should be treated as compromised and funds moved with a fresh seed on a clean device
Workarounds
- Treat credentials, browser sessions, Keychain secrets and wallet seed phrases on any affected host as exposed: rotate passwords, revoke sessions and migrate wallet funds
- Report malicious Shared Chats/Artifacts and ads to Anthropic and Google
Longer-term hardening
- Deploy EDR with behavioral detection for AMOS/AppleScript stealer activity and .NET process injection
- Train users on ClickFix: never paste commands from web pages or chats into Terminal, Run dialog or PowerShell
- Consider ad-blocking or search-ad filtering for managed browsers
- Restrict PowerShell execution (Constrained Language Mode, script block logging) and disable the Windows Run dialog where feasible
Timeline of ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts
- Earlier AMOS malvertising campaign reported using Google Ads, ClickFix and trojanized Ledger/Trezor apps with the same patterns later seen on claude.ai
- Related (separate) ClickFix variant abusing Claude artifacts to deliver macOS stealers observed (month-level date per Hackmag)
- Related, separate Claude shared-chat/GitLab Pages ClickFix malvertising campaign delivering MacSync stealer begins (Trend Micro; six waves, active through 2026-06-14)
- Trend Micro-observed MacSync malvertising campaign window ends after seven weeks of infrastructure rotation
- Earliest Gen Digital screenshots (2026-10-16 to 2026-10-23) of malicious claude.ai Artifacts promoted by Google Ads for macOS and Windows
- Gen observes rotating Artifacts across two ad campaigns with gclid/gad_campaignid parameters, indicating a funded, ongoing operation
- Gen Digital (Vojtech Moravec) publishes research on claude.ai Shared Chats/Artifacts abused with Google Ads to deliver AMOS, an obfuscated .NET RAT and trojanized wallet apps
- Cyber Security News reports the campaign; hunt ingestion for TL-2026-4511
Sources cited for ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts
- Hackers Abuse Claude's Official Website and Google Ads to Spread Malware
- Gen Digital: Claude content sharing abused to spread malware
- Hackers Are Using Claude Artifacts to Distribute macOS Malware (related MacSync campaign)
- ClaudeFix Campaign Abuses Shared Claude Chats to Deliver MacSync Stealer (Zscaler, related)
- Zscaler: ClaudeFix - Shared Claude Chats Meet ClickFix
- Trend Micro: claude.ai shared chat abused in malvertising (related MacSync campaign)
- Trend Micro: OpenClaw skills used to distribute Atomic macOS Stealer
- Experts warn this fake Claude install guide can be used to empty crypto wallets
- Google Ads diffonde malware su macOS tramite AI (prior AMOS malvertising)
Detection coverage for TL-2026-4511
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4511 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.