ClickFix Malvertising Campaign Uses Claude Shared Chats to Deliver MacSync Infostealer
Summary
Researchers tracked a malvertising campaign that used Google Ads and GitLab Pages, then Claude shared chats, to trick victims into running commands that install MacSync and steal credentials, cookies, SSH keys, and cryptocurrency wallets.
Key points
- The campaign ran in six waves from April 8 to June 14, 2026, using 106 malicious hostnames and ads impersonating AI developer tools and Mac utilities.
- Attackers initially hosted lures on GitLab Pages before directing victims to malicious public Claude shared chats beginning May 6.
- The chats posed as support pages and used ClickFix instructions to persuade macOS users to paste a command into Terminal.
- The command fetched scripts that checked for a Russian keyboard layout; systems that passed the check received the MacSync infostealer.
- MacSync harvested browser credentials and cookies, SSH keys, and cryptocurrency wallet files for exfiltration.
- The researchers recorded most victim traffic in Asia-Pacific, with Taiwan accounting for about 30.5% of traffic.
- Anthropic banned the responsible accounts, disabled the malicious chats, and said it was implementing additional abuse mitigations.
Article Details
- Attack Vectors
- Google Ads malvertising impersonating AI developer tools and Mac utilities, directing victims to malicious GitLab Pages sites and later to weaponized claude.ai shared chats.
- ClickFix social engineering instructed victims to open Terminal and paste a command that piped a curl download through base64 decoding.
- A shell script checked for a Russian keyboard layout or input method, then downloaded and executed MacSync when the check indicated the system should proceed.
- Defensive Notes
- Educate developers about ClickFix attacks involving AI tool installation workflows and monitor for unexpected PowerShell or terminal commands after web browsing.
- Use endpoint detection for the identified payload hashes and associated behavioral indicators.
- Navigate directly to official product websites rather than clicking software-download search ads; be suspicious of web pages asking users to paste commands, especially commands containing unreadable strings.
- Use official package managers to install developer tools.
- GitLab was advised to consider vetting or rate-limiting Pages sites exhibiting phishing or social-engineering characteristics; Anthropic was advised to detect abusive shared chats containing terminal commands or download instructions.
- Google Ads was advised to strengthen verification for ads directing users to GitLab Pages subdomains or AI-platform shared conversation URLs.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//loserrq0j1sha8[.]com/debug/loader[.]sh?build=a39427f9d5bfda11277f1a58c89b7c2d | Malicious loader URL whose script retrieves and executes the MacSync infostealer. |
MITRE ATT&CK
T1005 · Data from Local SystemMacSync collected cryptocurrency wallet files from infected systems.T1041 · Exfiltration Over C2 ChannelMacSync exfiltrated stolen data to a second-stage host.T1059.001 · PowerShellThe article describes ClickFix attacks generally as tricking victims into executing PowerShell or terminal commands; it does not specify PowerShell execution in the MacSync infection chain.T1059.004 · Unix ShellThe campaign used zsh scripts on macOS to retrieve and execute the infostealer.T1204.004 · Malicious Copy and PasteVictims were instructed to copy and paste a command from a malicious shared chat and execute it in Terminal.T1552.004 · Private KeysMacSync harvested SSH keys from infected systems.T1555.003 · Credentials from Web BrowsersMacSync harvested browser credentials and cookies.T1622 · Debugger EvasionThe loader checked whether a Russian keyboard layout or input method was enabled and stopped before its main objective when it was.
People
Malware
Vendors
AnthropicUpon being notified by TrendAI™ Research, Anthropic investigated and banned the accounts responsible, disabled the malicious shared conversations, and is implementing additional abuse mitigations for its shared chatGitLabThe threat actors used 92 unique malicious hostnames across GitLab Pages.GoogleCybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ai's own platform, turning the
Products
ChatGPT CodexThe campaign impersonated at least six legitimate brand names, including ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude AI, and claude.ai, and simultaneously ran Mac utility scam lures.Claude CodeVariants used in the campaign included "Claude Code," "Claude Desktop," and "Claude Desktop LM," different products Anthropic offers; this suggests that the attackers closely studied the product lineup.Claude DesktopVariants used in the campaign included "Claude Code," "Claude Desktop," and "Claude Desktop LM," different products Anthropic offers; this suggests that the attackers closely studied the product lineup.Claude Desktop LMVariants used in the campaign included "Claude Code," "Claude Desktop," and "Claude Desktop LM," different products Anthropic offers; this suggests that the attackers closely studied the product lineup.claude.aiThreat Actors Abuse claude.ai Shared Chat for ClickFix Malvertising CampaignCursor IDEThe campaign impersonated at least six legitimate brand names, including ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude AI, and claude.ai, and simultaneously ran Mac utility scam lures.GitLab PagesThe threat actors used 92 unique malicious hostnames across GitLab Pages.Google AdsCybercriminals hijacked Google Ads searches for popular AI developer tools to funnel over 2,000 victims toward malicious download pages before quietly moving their operation onto claude.ai's own platform, turning theJetBrainsThe campaign impersonated at least six legitimate brand names, including ChatGPT Codex, Perplexity, Cursor IDE, JetBrains, Claude AI, and claude.ai, and simultaneously ran Mac utility scam lures.Perplexity AIPerplexity AI: A single but persistent lure (perplexity-platform.gitlab.io) targeting users of the AI search engine.
Countries
FranceThe geographic targeting broadened in this wave, with victims who fell for the social engineering campaign coming from Singapore (43), Taiwan (35), India (23), Italy (21), and France (20).IndiaThe geographic targeting broadened in this wave, with victims who fell for the social engineering campaign coming from Singapore (43), Taiwan (35), India (23), Italy (21), and France (20).ItalyThe geographic targeting broadened in this wave, with victims who fell for the social engineering campaign coming from Singapore (43), Taiwan (35), India (23), Italy (21), and France (20).JapanA single Google Ads campaign ID (23736589328) drove the majority of the traffic, heavily targeting Taiwan (194 traffic counts), Malaysia (36), and Japan (34).MalaysiaA single Google Ads campaign ID (23736589328) drove the majority of the traffic, heavily targeting Taiwan (194 traffic counts), Malaysia (36), and Japan (34).SingaporeThe geographic targeting broadened in this wave, with victims who fell for the social engineering campaign coming from Singapore (43), Taiwan (35), India (23), Italy (21), and France (20).TaiwanAsia-Pacific region bore the brunt of the campaign, accounting for 67.2% of all confirmed victims, with Taiwan alone representing 30.5% of total traffic, a concentration that points to deliberate geographic ad