The Threat of MacSync

Cybersecurity firm Huntress has uncovered a dangerous six-stage malware campaign known as MacSync, which targets macOS users. The attack is initiated through a deceptive installation guide for Claude Code, which is deceptively promoted via paid Google advertisements and hosted on the legitimate claude.ai domain.


How the Attack Unfolds

The attack is notably sophisticated because it requires very little technical forgery to deceive users. The malicious guide is hosted directly under Anthropic's own security certificate, meaning users see an authentic HTTPS connection. By setting the display name to "Apple Support," the attacker manipulates the platform’s interface to make the fake instructions appear as official documentation from Apple.


Once a user follows the guide—which typically involves opening the Terminal and executing a specific command—the MacSync malware begins its multi-stage execution:

  • Infection: A stealer and a remote access Trojan (RAT) gain a foothold on the system.
  • Permission Escalation: A signed helper application is deployed to secure system permissions.
  • Wallet Hijacking: The malware locates installed Ledger and Trezor applications. It replaces these legitimate apps with Trojanized versions.

Harvesting Recovery Phrases

When the victim attempts to launch their cryptocurrency wallet app, the compromised version displays a fake recovery message. This is designed to trick the user into entering their secret recovery phrase, which the attackers then harvest to gain full access to the victim's digital assets.


Exploiting Platform Features

The success of this campaign stems from how Anthropic handles shared conversations. Any user can publish a chat to a public URL, which is then indexed by search engines. Because these pages are served on the official claude.ai domain, they carry an aura of absolute legitimacy.


As Huntress noted, this is not an isolated incident. Similar patterns have been observed using poisoned conversations on other AI platforms like ChatGPT and Grok. In these instances, attackers utilize the public nature of these chat logs to bypass standard security warnings that usually accompany malicious lookalike domains.


Staying Safe Online

This incident serves as a stark reminder of the risks associated with "malvertising." Even when a link appears at the top of a search engine result, it may not be safe. Experts emphasize the importance of exercising extreme caution when:

"Following commands from untrustworthy sources on the internet, even if they appear to come from a source that Google was paid to place above the correct answer."

Users should be wary of any "official" guide that directs them to copy and paste Terminal commands, particularly when those instructions are found through search advertisements rather than official developer documentation.