Mac users searching for Claude installation help have been led into a dangerous trap.

A malicious campaign used a paid search result and a fake guide on a legitimate Claude sharing page to persuade victims to paste a command into Terminal. That action started the MacSync information-stealing malware.

The campaign shows how software searches can become an entry point for account theft. Rather than exploiting a flaw, the operators relied on trust in a familiar domain, a convincing guide, and a command that looked like an installation step.

The result can be stolen browser sessions, passwords, cloud keys, and cryptocurrency wallet data. Huntress analysts identified the malware after investigating a macOS intrusion in mid-July.

Huntress said in a report shared with Cyber Security News (CSN) that MacSync combines credential theft, remote access, screen capture, and wallet-focused phishing in a six-stage chain.

The case echoes fake Google advertising campaigns, where sponsored results turn searches into malware delivery.

MacSync collects saved logins, cookies, keychain data, Telegram sessions, SSH and cloud credentials, then targets wallet extensions and desktop wallet applications.

How a Google-sponsored result reaches the advertiser (Source - Huntress) — How a Google-sponsored result reaches the advertiser (Source – Huntress)

It can also gain continued access after the initial theft, placing both personal accounts and business resources at risk. A stolen recovery phrase can give criminals lasting control of digital assets.

MacSync macOS Stealer Uses Fake Claude Guide

The victim searched Google for instructions to install Claude on a Mac and clicked a sponsored result instead of the genuine listing.

The ad led to a public Claude conversation styled as an Apple Support guide. It instructed the user to open Terminal and run a Base64-obscured curl command, an approach also seen in Claude artifact ad attacks.

That command fetched a loader, then retrieved the rest of the operation. The loader called a remote AppleScript directly into memory, reducing evidence on the device.

The weaponised claude.ai shared conversation, badged as shared by Apple Support, walking the victim through pasting a curl one-liner into Terminal (Source - Huntress) — The weaponised claude.ai shared conversation, badged as shared by Apple Support, walking the victim through pasting a curl one-liner into Terminal (Source – Huntress)

It also attempted to make the victim grant Terminal Full Disk Access, opening protected areas containing browser and system data.

Once access was granted, the AppleScript displayed a false system prompt and repeatedly requested the macOS account password until it validated.

It harvested browser cookies and saved logins, keychain secrets, cloud and developer files, and Telegram session data. The malware packaged the information for upload before removing temporary files.

MacSync goes beyond a one-time data grab. It installs a persistent remote-access tool that can run commands, transfer files, and capture the screen after obtaining permission.

This reflects malicious ad delivered backdoors, which can turn a deceptive download into prolonged system access.

Wallet Theft Raises Stakes

The operators gave MacSync a strong focus on cryptocurrency theft. The stealer searches for data linked to roughly 60 wallet browser extensions and 21 desktop wallet applications.

If it finds certain hardware-wallet companion applications, it can replace their contents with trojanised versions that appear normal when opened.

Those altered applications display a fake recovery process designed to collect the wallet’s seed phrase.

The phrase is sent to attacker-controlled servers, while the program returns the victim to the genuine application whether the transfer succeeds or fails. That can create irreversible loss because recovery phrases control the wallet itself.

Users should download software only from official vendor pages and treat sponsored results, shared AI conversations, and support posts as unverified until checked.

The six stages of MacSync, from the pasted curl one-liner to the trojanised wallet apps (Source - Huntress) — The six stages of MacSync, from the pasted curl one-liner to the trojanised wallet apps (Source – Huntress)

They should never paste commands into Terminal because a web page asks them to do so. Any unexpected Full Disk Access request during setup deserves close scrutiny, as noted in macOS ClickFix wallet theft.

Security teams should prioritize behavior, not just file hashes, because MacSync loaders change with each build.

Useful signs include Base64-decoded URLs piped into zsh, Terminal launching AppleScript from a curl request, unfamiliar LaunchAgents, re-signed wallet applications, and non-Apple screen capture.

Organizations should isolate suspected devices, rotate exposed passwords and tokens, and move wallet assets to a new recovery phrase from a trusted device if one may have been entered.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
Domain	agenticsora[.]com	Delivery infrastructure
Domain	malwareaudit[.]com	Alternate loader delivery infrastructure
URL	hxxp://agenticsora[.]com/curl?token	Zsh loader endpoint
URL	hxxp://agenticsora[.]com/dynamic?txd=token	Stage 3 AppleScript delivery
URL	hxxp://agenticsora[.]com/gate?build=txd&token=uploadid	Chunked data upload endpoint
URL	hxxps://agenticsora[.]com/loaderagent?token	Mach-O RAT download endpoint
URL	hxxps://agenticsora[.]com/loadercapture-agent?token	Screen-capture helper download
URL	hxxps://agenticsora[.]com/ledger?token	Trojanised wallet payload
URL	hxxps://agenticsora[.]com/ledgerlive?token	Trojanised wallet payload
URL	hxxps://agenticsora[.]com/trezor?token	Trojanised wallet payload
IP address	85.206.161[.]241:8443	RAT command-and-control server
IP address	103.216.221[.]95	Operator panel IP recorded in Stage 3 beacon
URL	hxxps://main.sdhomeinspectors[.]com/modules/wallets	Ledger recovery-phrase collection endpoint
URL	hxxps://main.southcarolinacounselor[.]com/modules/wallets	Trezor recovery-phrase collection endpoint
File artifact	/tmp/macsynctoken.lock	MacSync single-instance mutex
File artifact	/tmp/osalogging.zip	Archive containing staged stolen data
File artifact	/tmp/sync[random]	Collection staging directory
File artifact	/tmp/.kgrab.sh	Keychain Safe Storage theft script
File artifact	/tmp/.kpwd	Temporary captured password file
File artifact	~/.zshrc	Temporary curl and zsh persistence entry
File artifact	~/.local/com.apple.[8hex].hcpi	Dropped RAT binary
File artifact	~/.local/.mpwd	Captured account password used by RAT
File artifact	~/.local/com.apple.[8hex].capture.app	Screen-capture helper
File artifact	~/Library/LaunchAgents/com.apple.[8hex].hcpi.plist	LaunchAgent persistence
File artifact	/tmp/com.apple.tcc.prompted	TCC prompt tracking file
File artifact	/tmp/com.apple.tcc.result	TCC permission result file
Application artifact	Applications/LedgerWallet.app	Trojanised wallet application
Application artifact	Applications/LedgerLive.app	Trojanised wallet application
Application artifact	Applications/Trezor Suite.app	Trojanised wallet application
Command artifact	/usr/sbin/screencapture -x	Silent screen capture from a non-Apple parent process
SHA-256	3db8befc08dc02ab7a76b5193abd81653775e8f3ceac5864c7c2188b2dbd3c54	Dynamic AppleScript
SHA-256	3ae26ed89d3a1a140edc89ca78513aba2895789ed0d0f64cad6605b6f2347c7e	Universal Mach-O RAT
SHA-256	78dea0693ac2d70bdf8be7588667a75910e43fd84397ad484e710e37369a30f7	Capture-agent bundle
SHA-256	9c09c303fa058c2d3e179969bd58ca5523775ff2d310fb2f8266ac74cb21ee81	ScreenCap Mach-O
SHA-256	071bd109208eb1080ef525b5be394244cec467c59ffef5b8782cfb5e4850401d	Ledger Wallet trojan payload
SHA-256	31566a1df7070f30cb990aa5eab310c1d4e0266c8776e9438138e5438ec1cff8	Ledger Live trojan payload
SHA-256	230dff4bf9442a951dcd6898b2110924969a20668c20a43e3ceed6fcef65963e	Trezor Suite trojan payload

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Building Resilience Against Phishing & Malware and Analyze it in a safe environment – Power your SOC with ANY.RUN

The post MacSync macOS Stealer Uses Fake Claude Guide to Steal Passwords and Crypto Wallets appeared first on Cyber Security News.