MacSync macOS stealer spreads via Google Ads and Claude shared chats using ClickFix scam

Attackers abused Google Ads and Anthropic’s Claude shared-chat feature in a targeted June 2026 campaign to deliver a sophisticated macOS information stealer called MacSync, researchers at Zscaler disclosed.

The operation combined paid-search manipulation with trusted-host content to trick users searching for Claude-related downloads into executing terminal commands that seeded a multi-stage infection.

Between June 12 and June 19 the malicious shared Claude chats, branded by attackers as “Shared by Apple Support”, were hosted on Claude’s official domain, creating a veneer of legitimacy that persisted until Anthropic disabled the chats following notification.

MacSync macOS stealer

The initial lure relied on Google Ads purchased for queries such as “Claude download,” “Claude AI,” and “Claude Mac,” which redirected victims to the attacker-controlled shared-chat pages.

Those chats contained so-called ClickFix instructions: social-engineered prompts asking users to paste a one-line Terminal command to “install” or “repair” Claude, thereby bypassing conventional file-download defenses and relying on the victim’s manual execution to begin the compromise.

The one-line command uses curl to retrieve a Base64-encoded shell script from attacker infrastructure and pipes it directly into zsh.

That first-stage script decodes and decompresses a second-stage payload and executes it via eval, giving the operator a compact, obfuscated multi-stage infection chain that reduces visible artifacts.

The second-stage script suppresses output by redirecting to /dev/null, retrieves the core payload from a /dynamic?txd= endpoint using a hard-coded API key, and then runs the payload through osascript to minimize on-disk footprint.

After data collection, the malware bundles stolen artifacts into /tmp/osalogging.zip and uploads the archive in 10 MB chunks via HTTP PUT, retrying failed uploads up to eight times and deleting the archive afterward to limit forensic traces.

MacSync seeks broad and valuable macOS data. The stealer targets browser cookies and credential stores, Chromium and Gecko artifacts, password-manager extensions, shell histories, SSH keys, and cloud configuration files (AWS, Kubernetes).

It copies macOS Keychain databases and desktop cryptocurrency-wallet data, and specifically searches for web-wallet extensions and desktop wallet application files. To extend access, the malware modifies ~/.zshrc to establish persistence when Terminal is opened, and it displays a deceptive “Full Disk Access required!” prompt that opens macOS Security & Privacy settings in an attempt to convince users to grant broader permissions.

If users comply, MacSync removes its persistence artifacts and proceeds to collect more data. The operation also uses a fake macOS password prompt and gathers detailed system telemetry including hardware and process lists.

Zscaler’s analysis noted Russian-language comments in third-stage AppleScript code and the use of a large domain cluster styled as U.S. local-service websites to reduce suspicion.

Key indicators of compromise include the first-stage delivery URL path (defanged as lasvegaslaminateflooring[.]com/curl/…), the core /dynamic?txd= payload endpoint, wallet-specific endpoints (e.g., /ledger/, /trezor/), the temporary archive /tmp/osalogging.zip, and modification of ~/.zshrc. Detection names reported include HTML.Trojan.ClickFix and OSX.PWS.MacSync.

Organizations should block known malicious domains and monitor macOS endpoints for suspicious behaviors such as unexpected curl commands executed in zsh, changes to ~/.zshrc, creation of temporary archive files, and outbound HTTP PUT traffic.

Security teams should also educate users about the risks of pasting and executing terminal commands from web pages, especially those surfaced via ads, and apply endpoint controls that limit osascript execution and enforce least privilege to mitigate the impact of credential-stealing campaigns.