"MacSync": Fake Claude Install Guide Hosted on claude.ai/share Delivers a Six-Stage macOS Stealer and RAT

macOS users searching Google for instructions on installing Claude, with cryptocurrency holders as the primary objective

Huntress reverse-engineered a campaign that buys a sponsored Google result for queries such as "how to install Claude on a Mac" and lands the victim on a weaponized `claude.ai/share` conversation carrying a fake "Shared by Apple Support" badge. The page instructs the user to paste a base64-obfuscated `curl` command into Terminal, which pipes a payload from `agenticsora[.]com` or `malwareaudit[.]com` into `zsh` with certificate validation disabled. Six stages follow: a polymorphic loader that persists by editing `~/.zshrc`; a roughly 46KB server-side AppleScript stealer that fakes system dialogs to obtain Full Disk Access, validates the account password through `dscl`, and archives browser cookies, keychain secrets, Safe Storage keys, SSH keys, AWS credentials, and Kubernetes configs; a statically linked C++ Mach-O remote access trojan giving interactive shell and file transfer over an AES-256-CBC WebSocket channel; a separately signed helper app whose only job is to win the Screen Recording permission prompt; and re-signed trojanized builds of Ledger Wallet, Ledger Live, and Trezor Suite that show a fake update error followed by a seed-phrase recovery form to harvest BIP39 recovery phrases. Roughly 60 wallet browser extensions and 21 desktop wallet applications are targeted. Russian-language artifacts and technique overlap place it in the AMOS/Atomic Stealer lineage

The same trusted-domain laundering seen in the FakeAgent campaign a week earlier: the lure is a legitimate user-generated share page on the AI vendor's own domain, so there is no lookalike URL and no certificate warning, and paid search placement puts it above the vendor's own organic result. The install step is a copy-paste Terminal command, which no code-signing or notarization control inspects