CTI · corroborated · 2026-08-19

Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1204 User Execution Execution
• T1059 Command and Scripting Interpreter Execution
• T1027 Obfuscated Files or Information Stealth
• T1555 Credentials from Password Stores Credential Access
• T1041 Exfiltration Over C2 Channel Exfiltration

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: MacSync Stealer ClickFix curl Base64 Decode Execution
id: 7c8e4a1d-3f92-4b6a-a1d5-e8f0c2b4d6e9
status: experimental
description: >
    Detects the MacSync macOS stealer ClickFix execution pattern where a
    curl command downloads a Base64-encoded payload and pipes it through
    base64 --decode into zsh for execution. This technique was used in a
    campaign documented by Huntress and Microsoft Defender Experts
    (August 2026) that abused a legitimate Claude shared-conversation
    page on claude.ai to deliver MacSync via sponsored Google search
    results. The stealer harvests Keychain data, browser cookies, and
    crypto wallet files.
references:
    - https://gbhackers.com/fake-claude-steals-mac-passwords/
    - https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
    - https://cyberpress.org/fake-claude-guide-malware/
author: Tia N. List
date: 2026/08/19
tags:
    - attack.t1566
    - attack.t1204
    - attack.t1059
    - attack.t1027
logsource:
    category: process_creation
    product: macos
detection:
    selection_base64_decode:
        CommandLine|contains|all:
            - 'curl'
            - 'base64'
            - '--decode'
    selection_pipe_to_shell:
        CommandLine|contains|all:
            - 'curl'
            - '|'
            - 'zsh'
    condition: selection_base64_decode or selection_pipe_to_shell
falsepositives:
    - Legitimate development or DevOps scripts that use curl with base64 decoding
    - Package managers or installers that pipe curl output to a shell
level: high

References

• https://gbhackers.com/fake-claude-steals-mac-passwords/
• https://www.microsoft.com/en-us/security/blog/2026/08/18/hunting-macsync-stealer-infrastructure-through-behavioral-pivots/
• https://cyberpress.org/fake-claude-guide-malware/