MacSync Stealer Exploits Fake Claude Guide to Target macOS Users
A new macOS malware campaign, MacSync, uses deceptive search results and a fake guide to trick users into executing malicious commands, leading to the theft of passwords, crypto wallets, and session data.
macOS users seeking assistance with installing the AI chatbot Claude have become the target of a sophisticated new malware campaign dubbed MacSync. Threat actors are leveraging paid search results and a convincing fake guide, hosted on a legitimate Claude sharing platform, to lure victims into pasting malicious commands into their Terminal application. This seemingly innocuous step initiates the MacSync information-stealing malware, which then proceeds to pilfer sensitive data including passwords, cryptocurrency wallet information, and active session data.
The campaign's success hinges not on exploiting a technical vulnerability, but on social engineering and trust. By appearing as a legitimate guide on a familiar platform and presenting a command that resembles a standard installation step, the attackers exploit user confidence. This tactic is reminiscent of malvertising campaigns that use sponsored search results to deliver malware, turning a user's search for help into an entry point for account compromise. Huntress researchers identified MacSync after investigating a macOS intrusion in mid-July, detailing its multi-stage attack chain.
MacSync is designed as a comprehensive data-stealing tool, encompassing credential theft, remote access capabilities, screen capture, and a specific focus on cryptocurrency wallets. The malware systematically collects saved browser logins, cookies, keychain secrets, Telegram session data, SSH and cloud credentials, and targets both browser-based wallet extensions and desktop wallet applications. The inclusion of a persistent remote-access tool after the initial data exfiltration means that compromised systems remain at risk for prolonged periods, exposing both personal and business resources.
The attack chain begins when a victim searches Google for Claude installation instructions and clicks on a sponsored advertisement. This ad directs them to a public Claude conversation masquerading as an official Apple Support guide. The guide instructs the user to open Terminal and execute a Base64-encoded curl command. This command fetches a loader that, in turn, downloads and executes a remote AppleScript directly into memory, minimizing forensic evidence on the victim's machine.
Further escalating the danger, the malware attempts to trick the user into granting Terminal Full Disk Access, which is necessary to access protected system and browser data. Once granted, a fake system prompt appears, repeatedly requesting the macOS account password until it is validated. The AppleScript then proceeds to harvest a wide array of sensitive information, including browser cookies, saved logins, keychain secrets, cloud and developer files, and Telegram session data, before packaging it for exfiltration and deleting temporary files.
The threat actors have given MacSync a significant focus on cryptocurrency theft. The stealer is programmed to identify data associated with approximately 60 different wallet browser extensions and 21 desktop wallet applications. In a particularly insidious move, it can replace legitimate wallet applications with trojanized versions. When these altered applications are launched, they present a fake recovery process designed to trick users into revealing their wallet's seed phrase, which is then sent to attacker-controlled servers. Even if the fake transfer fails, the user is returned to the genuine application, potentially obscuring the compromise.
To mitigate the risks posed by MacSync and similar threats, users are strongly advised to download software exclusively from official vendor websites. Sponsored search results, shared AI conversations, and unofficial support posts should be treated with extreme caution and verified independently. Users should never paste commands into their Terminal based solely on a webpage's request. Any unexpected requests for Full Disk Access during software setup warrant close scrutiny. Security teams should prioritize behavioral analysis over file hashes, as MacSync loaders are frequently updated. Indicators of compromise include unusual Terminal activity, unfamiliar LaunchAgents, re-signed wallet applications, and unexpected screen capture processes.