Reported by 3 outlets

Timeline

1. original reporting

   Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps

   gbhackers.com · 55d ago · August 19th, 2026

   A Google-sponsored search result for Claude installation instructions is being used to deliver a sophisticated macOS stealer and remote-access trojan (RAT) named MacSync. The campaign abuses a legitimate Claude shared-conversation page on the claude.ai domain, demonstrating how trusted AI-hosting infrastructure can be weaponized to bypass users’ normal phishing instincts. The intrusion investigated by Huntress began […] The post Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from microsoft.com

   Hunting MacSync Stealer infrastructure through behavioral pivots

   microsoft.com · 56d ago · August 18th, 2026

   In this article Activity overview Discovery of additional rotating infrastructure Attack chain overview Mitigation and protection guidance References Learn more MacSync Stealer is a macOS-focused information stealer that relies on changing infrastructure to deliver payloads, communicate with compromised devices, and exfiltrate data. Earlier reporting by RST Cloud identified the threat through a limited set of domains and documented rapid command-and-control (C2) replacement after public disclosure. Microsoft Defender Experts expanded that view by correlating recurring endpoints and network behaviors across the activity. This behavior-led approach connected more than 30 domains and showed that the infrastructure supported more than C2 communication, extending into active collection, staging, and exfiltration. The findings demonstrate that although domains may rotate quickly, repeated execution patterns, request characteristics, staging behavior, and upload methods provide defenders with more durable opportunities to investigate MacSync Stealer activity. Activity overview Microsoft Defender Experts reviewed endpoint and network telemetry to determine which MacSync Stealer behaviors persisted as infrastructure changed. The investigation followed the activity from C2 communication through collection, staging, and exfiltration, using recurring technical traits to connect activity across rotating domains. Execution began from an interactive shell session consistent with ClickFix so

3. update from cyberpress.org

   Hackers Use Fake Claude Guide to Steal Mac Passwords and Hijack Crypto Wallet Apps

   cyberpress.org · 55d ago · August 19th, 2026

   The campaign abuses sponsored Google search results and a publicly shared page on the legitimate claude.ai domain, making the lure appear trustworthy. A victim searching for “How to install Claude Code on a Mac” clicked a paid Google advertisement that led to a Claude shared conversation branded as “Apple Support.” The page instructed the user to paste a command into Terminal to install Claude. Instead, the command downloaded and executed malware. The malicious command used curl to retrieve an obfuscated payload and pipe it directly into the Z shell ( zsh ). This ClickFix-style technique relies on social engineering rather than an exploit: the victim manually runs the attacker’s command in Terminal. Fake Claude Guide Malware The first-stage loader was a small zsh script containing a Base64-encoded and gzip-compressed payload. It changed between victims, reducing the value of simple file-hash detections. Huntress recommends defenders focus on behavioral signals, such as suspicious curl activity combined with Base64 decoding and shell execution. TCC prompt the script presents to the user to grant Full Disk Access (Source: huntress) The next stage fetched AppleScript from attacker-controlled infrastructure and ran it in memory through osascript . This allowed the operators to keep much of the stealer logic off the victim’