Cybercriminals are exploiting Google Ads to distribute a deceptive installation guide for Claude Code, leading unsuspecting macOS users to install the MacSync infostealer. This campaign transforms routine developer searches into avenues for credential theft and broader account compromises.
The attack initiates when a user searches for assistance with installing Claude Code and clicks on a sponsored result. The advertisement appears to direct users to Claude’s official website, lending an air of legitimacy to the guide. Consequently, victims are more likely to follow the provided terminal command without suspicion.
Security analysts have identified that the command employs Base64 encoding to obscure its true download source. Once executed, it retrieves MacSync, a malware designed to harvest passwords, browser sessions, developer credentials, and cryptocurrency wallet data.
Notably, this campaign does not rely on exploiting browser vulnerabilities, phishing emails, or compromised vendor websites. Instead, it leverages trusted web pages, familiar branding, and the common practice of selecting top search results to deceive users.
Deceptive Installation Guide
The sponsored advertisement features a Claude-themed headline and displays the legitimate claude.ai domain. Upon clicking, victims are redirected to an authentic Claude share page, presented as an installation guide purportedly shared by Apple Support, thereby creating multiple misleading trust signals.
The guide’s command conceals the server it contacts by using Base64 encoding and shell command substitution, revealing the destination only upon execution. This technique mirrors methods used in other malware campaigns that hide malicious activities from cursory inspections.
Once decoded, the command connects to infrastructure unrelated to the software vendor and employs curl’s `-k` option to bypass certificate validation. The same infrastructure facilitates payload delivery, command-and-control operations, and data theft targeting cryptocurrency wallets.
The operation also cycles through multiple Claude share-page lures within the same Google Ads campaign. This strategy implies that removing a single malicious guide or advertisement may not halt the broader campaign, similar to other attacks that exploit users searching for trusted software.
Credential Theft and Mitigation
MacSync is capable of extracting macOS Keychain information, stored browser passwords, session cookies, SSH keys, cloud credentials, Kubernetes configurations, and developer tokens. Stolen session cookies can enable attackers to hijack active accounts without triggering multi-factor authentication challenges.
For developers, the ramifications extend beyond a single device. Access to source code repositories, cloud environments, package publishing accounts, and deployment systems may be compromised, underscoring the expanding focus of macOS infostealer campaigns on developer-centric workflows.
The malware also targets Telegram Desktop sessions and over 80 cryptocurrency wallets. Researchers caution that it can modify Ledger Live to capture wallet information, meaning that merely deleting the infostealer may leave a compromised wallet application intact.
MacSync establishes persistence through a LaunchAgent that mimics a Google Keystone updater and leaves staging files on the system. Security teams should consider any execution of the command as a complete device and credential compromise, rather than assuming that antivirus cleanup alone resolves the incident.
Users are advised to avoid sponsored search results when installing developer tools and instead access the vendor’s official documentation directly. Before executing any terminal command, they should decode hidden text, scrutinize every destination, and reject commands that disable certificate checks or connect to unrelated domains.
If the command has been executed, the affected Mac should be immediately isolated and not used for recovery actions. From a clean device, victims should change passwords and keys, revoke browser and developer sessions, review source code and CI/CD activity, transfer cryptocurrency to a new wallet, and reimage the compromised Mac.
This incident highlights the evolving tactics of cybercriminals who exploit trusted platforms and user behaviors to distribute malware. It underscores the importance of vigilance when downloading and installing software, even from seemingly legitimate sources. Developers and users alike must exercise caution, verify the authenticity of installation guides, and remain skeptical of commands that obscure their true intentions.
