MacSync Stealer Campaign Uses Malvertising and Shared Claude Chats to Target Mac Users

Jul 15, 2026 · Original article ↗

Summary

Zscaler describes a ClickFix campaign that used Google ads and shared Claude chats to deliver MacSync Stealer to Mac users, where it could steal credentials, files, and cryptocurrency data. The shared chats were inaccessible by publication.

Key points

Google ads targeting Claude searches led users to shared Claude chats impersonating Apple Support and hosting malicious paste-and-run instructions.
The commands downloaded and executed staged scripts that deployed MacSync Stealer on macOS.
The malware could steal keychain and browser credentials, files, cloud keys, Telegram data, and cryptocurrency wallet information.
It used a fake macOS password prompt and could add persistence through the user's .zshrc file.
Stolen data was compressed, uploaded in 10 MB chunks over HTTP, and deleted from the system after exfiltration.
Zscaler observed the campaign from June 12–19, 2026, and said Anthropic was notified and the shared chats were no longer accessible at publication.

Article Details

Attack Vectors: Paid search ads directed users searching for Claude to shared Claude chats containing ClickFix instructions.
Victims were instructed to run an obfuscated curl command in zsh; it downloaded and executed staged MacSync Stealer scripts.
The malware collected credentials, browser and cryptocurrency wallet data, files, and system information, then exfiltrated an archive in HTTP PUT chunks.
When access to the user’s Library/Cookies directory failed, the malware modified ~/.zshrc to run its second-stage script when a terminal opened.
Defensive Notes: Zscaler reported notifying Anthropic about the misuse; the campaign’s shared chats were no longer accessible at publication time.
Zscaler said its platform detects related activity under the threat names HTML.Trojan.ClickFix and OSX.PWS.MacSync.
The article provides the listed malicious hosting domains and staging URLs as indicators for detection and blocking.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`3plfast[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`589669[.]cc`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`5x5web[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`625167[.]cc`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`699524[.]cc`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`advertisingeffectively[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`affordabletentrentals[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`agingfighter[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`aidevmaster[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`aigenerativeos[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`aisolutions247[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`alabamarecoverycenter[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`aleeci[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`alluringsites[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`amedatur[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`anvil-89[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`anvil-wave[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`anvillyric1[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`api-metrics-5453[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`apxeagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`arbokfind[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`arbookfind[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`aspen32[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`atlanticwoodworking[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`ballad82[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`balladspark[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`bcrealestateagency[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`beachjiujitsu[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`belldredgingpump[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`bestbuydomain[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`bitcoinlnwallet[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`blueprintmesh[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`briskinternet[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`browserling[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`buynewgymequipment[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`buywx[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`byrnewealthmanagement[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`cabinrentalsnc[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`canvas-coral[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`cashlessend[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`cedar-satin[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`centralfloridapowerwash[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`chant-78[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`charlottefilmstudios[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`chicagometalscrap[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`chisel-perch[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`cincycarpetcleaning[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`codxeagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`coeragent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`coloradoaffordablelawyer[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`coloradoconstructionsupply[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`conenctagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`curretagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`customroofingcontractors[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`dallasirrigationservices[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`dallasoverheaddoors[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`delta-66[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`denverplumbingandwaterheater[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`dogtrainersgeorgia[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`dramshopliabilityattorney[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`driftpress11[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`drivinguber[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`dualverify[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`dubaivehiclemart[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`ednasoftware[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`elitefenceanddeck[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`emberjourney18[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`empexf[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`envestassetmanagement[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fablecube15[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fern-76[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fern16[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`flintfeather5[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`floridakitchencabinet[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`floridavacationvillarental[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`forgeboost16[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`forgequest2[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fractocode[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fredscarpetcleaning[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`fullcolorprinters[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`gainesvillewebsitedesign[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`garagedoorskentucky[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`garden13[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`gatravelagency[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`genomicsforge[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`georgia[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`glowworkshop15[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`greenactiv[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`harbor-29[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`harvest-53[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`havenaspen2[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`hawaiiwindowtinting[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`healthcareqai[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`homeinspectionnaperville[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`homeinspectionsdelaware[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`houstonpestcontrolcompany[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`ideanica[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`iowagaragedoor[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`jerryshvac[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`journey71[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`jozuvisuals[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kernel-frame[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kernelfable[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kidsjumpandplay[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kirkcharlie[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kitchenbathremodels[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kitefeather5[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kiteshore[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`kylesplumbing[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lakevine8[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lalandscapelighting[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`languageschoolai[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lasvegaslaminateflooring[.]com`	MacSync Stealer staging and payload-hosting domain used in the campaign.
DOMAIN	`lasvegasweddingreception[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`leaflyric4[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lens-kite[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lifecoachrochester[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`longbeachmartialarts[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`luxuryswisshomes[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`lyricopal1[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`majordubai[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`maplecirrus[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`marbellaresales[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`meadow84[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`meshfeed4[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`miamidadenotary[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`miamipcsupport[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`modernhomeai[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`moldinspectiondayton[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`napavalleymentalhealth[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`nationalspacecouncil[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`ncsolarpanel[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`newjerseypetsitter[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`nimbusstratos12[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`olympiapetemergency[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`onyxkite[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`orbitstitch5[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`orbitstride7[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`paeviction[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pdrncosmetics[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pearl-49[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pearlswift16[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`perch-74[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pine-1[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pinescope11[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`plumechisel[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`prmieagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`proviewhomeinspections[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`pubre[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`purtwre[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`quartzleap5[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`quest-38[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`quest-raster[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`quill-67[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`quillchisel20[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`realtorsmichigan[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`renderframe20[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`robscarpetcleaning[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`rudder-bloom[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`rudder93[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`rudderwillow8[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`satin40[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`satin87[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`scope-quest[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`sdlasik[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`seattlefilmstudios[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`shoresatin[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`slate16[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`slatesatin[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`smratagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`sonyda[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`spotlessridesdetailing[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`sreachagent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`stelaragent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`stitchstratos[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`stratos37[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`stratosnova14[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`summit-68[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`summit86[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`suzke[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`swisshomesforsale[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`syracusefertilitycenter[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`thevenueapartments[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`tide-39[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`tide-maple[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`toledotreeservices[.]com`	Listed as a MacSync Stealer hosting domain and observed in the campaign’s malicious domain set.
DOMAIN	`touristprogram[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`trailblazehealth[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`trailshore17[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`trekmesh15[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`trufflecatering[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`unifiedaiapi[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`ursamade[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`vacationrentalvirginia[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`verse-57[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`vibestride8[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`vinebridge12[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`vineworkshop1[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`web-stat-2685[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`whichitaautosales[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`willow-blaze[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`wolfwraps[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`workshopcurrent[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`workshoplens[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`xprssit[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`yoauction[.]com`	Listed as a MacSync Stealer hosting domain.
DOMAIN	`znoeagent[.]com`	Listed as a MacSync Stealer hosting domain.
URL	`hxxp[:]//lasvegaslaminateflooring[.]com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb`	Example first-stage URL serving a zsh script in the MacSync Stealer infection chain.