Huntress security researchers have reverse-engineered a sophisticated macOS malware family called MacSync, discovered after investigating an intrusion that began with a malicious Google advertisement. The attack targeted users searching for instructions to install Anthropic's Claude AI assistant on Mac computers. Victims clicked a sponsored search result that appeared above Anthropic's legitimate listing, leading to a fake installation guide hosted as a publicly shared Claude conversation on the genuine claude.ai domain. Because the malicious page resided on Anthropic's own infrastructure with a valid certificate, it bypassed typical phishing red flags such as suspicious domains or certificate warnings.
The infection begins when victims paste a seemingly simple curl command into Terminal, triggering a deliberately lightweight zsh loader. This first stage unpacks and executes a second-stage script in memory, which then retrieves a 46KB AppleScript payload from the attacker's server on demand. By keeping this critical stage server-side and gated behind a static API key, the operators can modify the malware's behavior without leaving recoverable payloads on victim systems. The AppleScript component manipulates victims into granting Full Disk Access through spoofed system dialogues and establishes persistence by writing entries into the user's shell profile.
The malware then deploys a fake System Preferences prompt to phish the account password, validating each attempt in real time against macOS's Open Directory service until the correct password is entered. With Full Disk Access and a validated password, MacSync harvests Safe Storage encryption keys from the login keychain to decrypt saved credentials and cookies from thirteen Chromium-based browsers. The stealer also targets SSH and cloud credentials, Telegram session data, and approximately 21 desktop cryptocurrency wallet applications. A native C++ remote access trojan, installed as a persistent LaunchAgent, provides operators with an interactive shell and file transfer capability over a TLS-encrypted command-and-control channel. A separate helper binary, disguised as "Screen Recording," acquires screen-recording permissions to capture the victim's display.
The most damaging capability targets hardware wallet companion software including Ledger Live, Ledger Wallet, and Trezor Suite. When these applications are detected, MacSync downloads modified application bundles, replaces the legitimate files, and re-signs the apps with ad-hoc signatures so they continue to launch normally. When victims open what appears to be their trusted wallet manager, the tampered application displays a convincing recovery-phrase entry screen and exfiltrates any seed phrase entered directly to attacker infrastructure. Analysis revealed that 26 of 30 unpacked files were byte-identical across builds for different Ledger products, indicating operators reused a single patched payload rather than creating bespoke versions per application.
Huntress noted the credential-theft component closely mirrors tradecraft from the AMOS (Atomic Stealer) malware family, including AppleScript usage, password validation methods, and targeting lists. Russian-language developer comments were found in recovered source code, though Huntress stopped short of formal attribution. The firm recommends defenders hunt for behavioral indicators rather than file hashes, including curl commands piping base64-decoded content into zsh or osascript, LaunchAgent plists pointing to unsigned binaries disguised as updater processes, screencapture invocations from non-Apple parent processes, and ad-hoc code signatures applied to applications that should carry vendor signatures. This marks the third case Huntress has documented this year of malware distributed via poisoned search results pointing to AI-hosted installation guides.
Source: https://www.itsecurityguru.org/2026/07/30/fake-claude-install-guide-delivers-six-stage-macos-stealer-and-rat-huntress-finds/