# ClickFix Campaign Abuses Claude.ai Shared Chats/Artifacts and Google Ads to Deliver AMOS Stealer and Windows .NET RAT

> Cybercriminals hosted malicious content as user-generated Shared Chats and Artifacts on claude.ai and promoted them via paid Google Ads. Victims were given ClickFix instructions to paste obfuscated commands into Terminal (macOS) or PowerShell (Windows), delivering Atomic macOS Stealer (AMOS), an obfuscated .NET remote-access executable, and trojanized Ledger Live, Ledger Wallet and Trezor Suite apps that harvest recovery phrases.

- **Published:** 2026-10-27T05:09:22Z
- **Last reviewed:** 2026-10-27T05:09:22Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4511
- **ID:** TL-2026-4511
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Gen Digital researcher Vojtech Moravec reported (2026-10-26) an active, apparently funded malvertising operation that abuses the legitimate claude.ai domain. Attackers publish user-generated Shared Chats (claude.ai/share/...) and public Artifacts (claude.ai/artifact/...) that impersonate Claude download/installation guides, then buy Google Ads so that searches for Claude downloads surface these pages under a trusted domain. Ad click-through URLs carried the gclid and gad_campaignid parameters, and Gen observed multiple rotating Artifacts across two separate ad campaigns (screenshots dated 2026-10-16 to 2026-10-23), indicating a sustained operation rather than a one-off case.

The macOS branch presents a fake 'Download Claude' page via an Artifact with an 'Install on macOS' dialog and uses the ClickFix technique: the victim copies a command, pastes it into Terminal and presses Enter. The command is scrambled so the visitor sees only gibberish; because the user runs it themselves, nothing suspicious is 'downloaded' from a detection standpoint. The chain is a loader script fetched from an attacker server, a second-stage unpacker script, then an AppleScript-based Atomic macOS Stealer (AMOS) payload. AMOS collects passwords and session cookies from Chromium- and Gecko-based browsers, decrypts Keychain data, steals cryptocurrency wallet data (browser extensions and desktop apps: Electrum, Exodus, Ethereum, Bitcoin, Ledger, Trezor), and searches for files with the extensions .pdf, .docx, .key, .seed, .pem, .wallet and .ovpn. When the process lacks Full Disk Access, fake system dialogs are used to socially engineer the user and shell startup files are modified. Collected data is compressed into a ZIP, uploaded to the attacker server, and temporary files are cleaned up. A later stage replaces installed Ledger Live/Ledger Wallet and Trezor Suite applications with trojanized versions that prompt the user for a wallet recovery phrase, which is sent to a second attacker server.

The Windows branch uses an 'Install Claude on Windows' Artifact that instructs the victim to press Win+R, paste (Ctrl+V) and press Enter, running an obfuscated PowerShell command that prints fake progress messages ('Challenge in progress... 50% done... 70% done'). It retrieves, via GitHub and github.io pages, an encrypted, heavily obfuscated .NET executable with remote-access capability. Gen reports code injection into legitimate Windows processes, antivirus-detection checks, desktop screenshot capture, window-title logging, wallet targeting (Electrum, Exodus, Ethereum, Bitcoin, Ledger) and a persistent command channel to attacker servers. The source does not disclose IP addresses, C2 domain names or file hashes, so the IOC set is limited to abused platform URL patterns, staging infrastructure class, ad-tracking parameters, malware/tool names and behavioral indicators. Separate Claude-themed ClickFix campaigns delivering MacSync stealer (Zscaler 'ClaudeFix'; Trend Micro, active 2026-04-08 to 2026-06-14, GitLab Pages hosts and 45+ weaponized shared chat IDs) use different infrastructure and are cited as related context only, not as confirmed same-actor activity.

## MITRE ATT&CK

- T1583.008 Malvertising
- T1608 Stage Capabilities
- T1684.001 Impersonation
- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1546.004 Unix Shell Configuration Modification
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1055 Process Injection
- T1070.004 Indicator Removal: File Deletion
- T1518.001 Software Discovery: Security Software Discovery
- T1010 Application Window Discovery
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1056.002 Input Capture: GUI Input Capture
- T1005 Data from Local System
- T1113 Screen Capture
- T1560 Archive Collected Data
- T1219 Remote Access Tools
- T1657 Financial Theft

## Sources

- [Hackers Abuse Claude's Official Website and Google Ads to Spread Malware](https://cybersecuritynews.com/claudes-official-website/)
- [Gen Digital: Claude content sharing abused to spread malware](https://www.gendigital.com/blog/insights/research/claude-content-sharing-malware)
- [Hackers Are Using Claude Artifacts to Distribute macOS Malware (related MacSync campaign)](https://hackmag.com/news/claude-malware)
- [ClaudeFix Campaign Abuses Shared Claude Chats to Deliver MacSync Stealer (Zscaler, related)](https://cyberpress.org/claudefix-campaign-claude-macsync-stealer/)
- [Zscaler: ClaudeFix - Shared Claude Chats Meet ClickFix](https://www.zscaler.com/br/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix)
- [Trend Micro: claude.ai shared chat abused in malvertising (related MacSync campaign)](https://www.trendmicro.com/en/research/26/f/claudeai-shared-chat-abused-in-malvertising.html)
- [Trend Micro: OpenClaw skills used to distribute Atomic macOS Stealer](https://www.trendmicro.com/en/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [Experts warn this fake Claude install guide can be used to empty crypto wallets](https://techradar.com/pro/security/experts-warn-this-fake-claude-install-guide-can-be-used-to-empty-crypto-wallets)
- [Google Ads diffonde malware su macOS tramite AI (prior AMOS malvertising)](https://www.tomshw.it/hardware/google-ads-diffonde-malware-su-macos-tramite-ai-2025-12-11)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4511