Fake Claude Install Guide Deploys MacSync Stealer, Trojanizes Crypto Wallets

Key Takeaways

• Mac users seeking to install Claude AI are being targeted by a sophisticated malware campaign leveraging fake installation guides.
• The attack chain, dubbed “MacSync,” deploys an information stealer and remote access trojan (RAT) capable of exfiltrating sensitive data, including credentials, cloud keys, and cryptocurrency wallet recovery phrases.
• The campaign utilizes paid Google search results and a seemingly legitimate Claude.ai conversation to trick users into executing a malicious Terminal command.
• A critical component of the attack involves trojanizing popular cryptocurrency wallet applications, prompting users to input their recovery phrases into compromised software.
• Defenders should prioritize caution with unofficial installation instructions, scrutinize permission requests, and monitor for suspicious shell activity.

Mac users are falling victim to a cunning malware campaign that transforms a seemingly straightforward installation of the Claude AI assistant into a comprehensive device compromise. Threat actors are exploiting the rising popularity of AI tools, employing deceptive tactics to deploy the MacSync information stealer and a persistent remote access trojan.

The elaborate scheme initiates when users search Google for “how to install Claude on a Mac” or similar queries. Attackers leverage sponsored search results to direct victims to a fraudulent Claude conversation hosted on Claude.ai, meticulously crafted to mimic official Apple Support documentation. This strategic use of a trusted domain lends an air of legitimacy to the malicious instructions, a tactic reminiscent of previous ClickFix campaigns that exploited shared Claude chat features.

The MacSync Attack Chain

The fake installation guide instructs users to copy and paste a curl command into their Terminal. This command, designed to appear innocuous, is the entry point for MacSync. According to a report from Huntress, who identified the activity after responding to a customer incident in July, this single Terminal command sets in motion a six-stage kill chain with profound implications for both individuals and organizations.

Upon execution, a small zsh loader is launched, which then unpacks an encoded payload. This initial loader is polymorphic, changing for each victim, which renders traditional file-hash blocking ineffective. Security analysts must instead focus on detecting anomalous curl activities, the presence of Base64 encoded content within shell commands, and unexpected downloads initiated via Terminal.

Following the initial compromise, MacSync executes an AppleScript directly in memory, requesting elevated macOS permissions, including Full Disk Access. Should the user grant these permissions, the stealer gains the ability to harvest a wide array of sensitive data. This includes browser cookies, saved login credentials, Keychain secrets, account passwords, Telegram session data, and cloud credentials. The researchers emphasize that such permission prompts warrant extreme scrutiny, as highlighted by prior macOS ClickFix attack tactics.

Beyond data exfiltration, MacSync establishes persistence by installing a remote access trojan (RAT) through a LaunchAgent, ensuring it survives system reboots. This RAT provides attackers with an interactive shell, enabling them to execute arbitrary commands and transfer files to and from the compromised machine. Furthermore, a separate signed helper application seeks Screen Recording permission, allowing the attackers to visually monitor the victim’s desktop activity once consent is granted.

Wallet Trojans Raise Stakes

The most alarming phase of the MacSync operation targets cryptocurrency users. The malware actively scans for dozens of popular cryptocurrency browser extensions and desktop wallet applications, as well as companion software for hardware wallets. It then proceeds to copy and rewrite these legitimate applications, effectively trojanizing them.

When a victim subsequently opens a modified wallet application, it may display a fabricated error page, deceptively requesting the user’s cryptocurrency wallet recovery phrase. Unlike a password, which can be reset, a recovery phrase (or seed phrase) grants complete control over all funds associated with that wallet. Any attacker who obtains this phrase can drain the victim’s cryptocurrency assets without further interaction, a danger mirrored in other wallet replacement malware risks.

What You Should Do

• Verify Software Sources: Always download software directly from official vendor websites. Avoid using search engine ads or third-party download sites for critical applications.
• Scrutinize Terminal Commands: Never paste commands into your Terminal without thoroughly understanding their function and verifying their legitimacy from a trusted source.
• Review Permission Requests: Pay close attention to macOS permission prompts, especially those requesting Full Disk Access or Screen Recording. Only grant permissions to applications you explicitly trust and understand the necessity for.
• Monitor for Suspicious Activity: For security teams, implement robust monitoring for unusual curl commands, shell scripts containing encoded content (e.g., Base64), and unexpected downloads or persistence mechanisms.
• Incident Response: If you suspect compromise, immediately disconnect the affected Mac from all networks. Change all exposed passwords from a clean, uncompromised device. For cryptocurrency holders, transfer all assets to a new, secure wallet created on a clean system. Organizations should conduct a thorough forensic investigation of browser sessions, cloud access tokens, and persistence entries, as merely removing the visible installer may not eliminate the attacker’s presence.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.