cyber.hendryadrian.com
Threat Research · gendigital.com

Attackers Abuse Claude Sharing Pages to Deliver macOS and Windows Malware

· Original article ↗

Summary

Gen Digital details macOS and Windows campaigns that abused Claude sharing pages and Google Ads to deliver ClickFix malware, including AMOS, credential and wallet theft, and a Windows remote-access payload.

Key points

  • Attackers hosted fake software-install pages as user-generated Shared Chats and Artifacts on claude[.]ai; the campaigns did not require compromising Anthropic’s infrastructure.
  • Paid Google Ads promoted the malicious pages, which used Claude branding and instructions to run commands rather than download installers.
  • On macOS, a pasted Terminal command downloads scripts that install Atomic macOS Stealer (AMOS); it waits for Full Disk Access before harvesting credentials, browser sessions, wallets, and files.
  • AMOS can replace Ledger and Trezor applications with trojanized versions that prompt users for wallet recovery phrases.
  • A separate Windows campaign uses Win+R and Ctrl+V to run a malicious PowerShell command, which downloads a packed .NET payload via github[.]io.
  • The Windows malware injects code into a normal process, checks for antivirus software, captures screenshots and window titles, maintains a connection for further commands, and searches for cryptocurrency wallets.
  • Gen Digital advises users not to run commands they did not write, to download software from vendors’ official sites, and never to enter wallet recovery phrases into unexpected software prompts.

Article Details

Attack Vectors
  • Attackers used paid Google Ads to direct users to fake Claude download pages hosted as user-generated Shared Chats and Artifacts on claude.ai.
  • The macOS lure instructed users to paste an obfuscated command into Terminal; the command downloaded scripts that delivered Atomic macOS Stealer (AMOS).
  • A separate Windows lure used ClickFix steps to have users paste and run a malicious PowerShell command, which retrieved a packed and encrypted .NET payload from a github.io page.
  • AMOS collected passwords, browser session cookies, Keychain keys, cryptocurrency wallets, and selected files, then uploaded the collected data in a ZIP file to an attacker server.
  • AMOS could replace Ledger Live, Ledger Wallet, or Trezor Suite with trojanized versions that prompted users to enter wallet recovery phrases.
  • The Windows malware injected code into a normal process, checked for antivirus software, took screenshots, read the active window title, searched for cryptocurrency wallets, and maintained a connection for further commands.
Defensive Notes
  • Do not paste commands into Terminal or PowerShell unless you wrote them yourself.
  • Download software by typing the vendor's official address or using a bookmark; do not trust sponsored search results.
  • Treat user-generated or unverified labels on sharing pages as a warning, especially when a page presents itself as a software installer.
  • Do not enter a wallet recovery phrase into an unexpected prompt inside an application.
  • Keep reputable security software enabled. If compromise is suspected, change important passwords from a clean device, log out of sessions, enable multi-factor authentication, move cryptocurrency to a wallet created with a new recovery phrase, and reinstall wallet applications from official vendors.

MITRE ATT&CK

T1005 · Data from Local SystemAMOS collected local files with extensions including .pdf, .docx, .key, .seed, .pem, .wallet, and .ovpn.T1027 · Obfuscated Files or InformationThe macOS command was obfuscated, and the Windows .NET payload was described as heavily obfuscated, packed, and encrypted.T1055 · Process InjectionThe Windows malware injected its code into a normal Windows process.T1056.002 · GUI Input CaptureAMOS displayed a fake macOS System Preferences password prompt and retained the password entered by the victim.T1059.001 · PowerShellThe Windows lure had victims paste and run a malicious PowerShell command.T1059.002 · AppleScriptThe macOS payload is described as an AppleScript-based infostealer.T1059.004 · Unix ShellThe macOS lure had victims run a command in Terminal, and the malware added a line to a shell startup file.T1105 · Ingress Tool TransferThe macOS command downloaded a loader script and subsequent script and payload stages; the Windows script retrieved a later stage from a github.io page.T1113 · Screen CaptureThe Windows malware took screenshots of the desktop.T1204.004 · Malicious Copy and PasteThe lures instructed victims to copy and paste attacker-supplied commands into Terminal or the Windows Run dialog.T1518.001 · Security Software DiscoveryThe Windows malware checked which antivirus software was present.T1539 · Steal Web Session CookieAMOS collected browser session cookies.T1546.004 · Unix Shell Configuration ModificationWhen Full Disk Access was unavailable, the macOS malware added a line to a shell startup file so it would run again when Terminal was opened.T1555.001 · KeychainAMOS collected Keychain keys to decrypt saved logins.T1555.003 · Credentials from Web BrowsersAMOS harvested saved passwords from Chromium- and Gecko-based browsers.

Malware

Atomic macOS Stealer (AMOS)and paste it into the Terminal on their Mac. Everybody who followed these steps installed Atomic macOS Stealer (AMOS) — a malware that is made to steal passwords, browser sessions, cryptocurrency wallets and other

Vendors

Anthropicone thing about it was unusual: the web address was real. The page was hosted on claude.ai, which is Anthropic’s own domain. It had Claude’s branding and what looked like simple instructions to install the desktopGoogleand what looked like simple instructions to install the desktop application. The attackers even paid for Google ads to send people there.

Products

ClaudeWe found a fake “Download Claude” page, and one thing about it was unusual: the web address was real. The page was hosted on claude.ai, which is Anthropic’s own domain. It had Claude’s branding and what looked likeGoogle Adswhat looked like simple instructions to install the desktop application. The attackers even paid for Google ads to send people there.Ledger LiveWhen the stealer sees that Ledger Live, Ledger Wallet, or Trezor Suite is installed, it downloads a trojanized copy of this application from the attacker and puts it over the real one. The modified application looks andLedger WalletWhen the stealer sees that Ledger Live, Ledger Wallet, or Trezor Suite is installed, it downloads a trojanized copy of this application from the attacker and puts it over the real one. The modified application looks andTrezor SuiteWhen the stealer sees that Ledger Live, Ledger Wallet, or Trezor Suite is installed, it downloads a trojanized copy of this application from the attacker and puts it over the real one. The modified application looks and

Industries

Cryptocurrencyinstalled Atomic macOS Stealer (AMOS) — a malware that is made to steal passwords, browser sessions, cryptocurrency wallets and other sensitive data.

Related Articles