Huntress Details Six-Stage MacSync Stealer and RAT Delivered Through Fake Claude Install Instructions
Summary
Huntress traced a MacSync infection from a Google sponsored result to a fake Claude install guide, detailing a six-stage macOS attack that steals credentials and crypto recovery phrases and installs a persistent RAT.
Key points
- A sponsored Google result led users to a shared conversation on the legitimate claude[.]ai domain, impersonating Apple Support and instructing them to paste a curl command into Terminal.
- The ClickFix command launched a six-stage chain: a zsh loader, in-memory execution, a server-generated AppleScript stealer, a persistent Mach-O RAT, a screen-capture helper, and trojanized wallet apps.
- MacSync targets browser cookies and logins, keychain secrets, account passwords, Telegram sessions, SSH and cloud keys, and cryptocurrency recovery phrases.
- The RAT persists through a LaunchAgent and supports remote control, command execution, file transfer, and communication with its operators.
- The campaign prompts users for macOS permissions, including Full Disk Access and Screen Recording; the wallet trojans display fake errors to solicit recovery phrases.
- Huntress recommends behavior-based detection for curl-triggered shell commands and Base64 content; it also highlighted BlockBlock and LuLu Firewall for monitoring macOS persistence and network activity.
Article Details
- Attack Vectors
- A sponsored Google search result led the victim to a maliciously crafted shared Claude conversation on the legitimate claude.ai domain, which impersonated Apple Support and used ClickFix instructions to persuade the victim to paste a curl command into Terminal.
- The command launched a zsh loader and a six-stage chain that delivered MacSync components, including an AppleScript stealer, a Mach-O RAT, a screen-capture helper, and trojanized wallet applications.
- The malware requested Full Disk Access and prompted the victim to enter their password; it then stole browser data, keychain secrets, credentials, sessions, and cryptocurrency recovery phrases.
- The RAT established persistence through a LaunchAgent and communicated with a direct C2 endpoint, with an obfuscated delivery-domain fallback.
- Trojanized wallet apps displayed recovery-phrase phishing prompts when opened by the victim.
- Defensive Notes
- Inspect commands before pasting them into Terminal; treat opaque Base64 content and unexpected curl commands as suspicious.
- Huntress analysts suggested behavioral detection for curl triggers combined with Base64 content in shell because the loader is polymorphic and hash-based detection may be ineffective.
- Huntress analyst Jamie Levy cited Objective-See's BlockBlock and LuLu Firewall as tools that could help detect the described persistence tactics.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 85[.]206[.]161[.]241 | Direct C2 IP address used by the MacSync RAT over WebSocket over TLS. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe loader payload was gzip-compressed and Base64-encoded, and the RAT's fallback delivery domain was obfuscated with single-byte XOR.T1056.002 · GUI Input CaptureThe victim was prompted to enter a password, which the malware validated.T1059.002 · AppleScriptThe stealer used an AppleScript payload executed with osascript.T1059.004 · Unix ShellThe initial command used a zsh loader executed from Terminal.T1071.001 · Web ProtocolsThe RAT communicated with its direct C2 over WebSocket over TLS.T1113 · Screen CaptureA separately signed helper captured the screen and wrote an image to disk.T1189 · Drive-by CompromiseThe victim reached the malicious shared Claude conversation through a sponsored search result.T1204.004 · Malicious Copy and PasteThe ClickFix instructions induced the victim to copy and paste a command into Terminal.T1539 · Steal Web Session CookieMacSync collected browser cookies.T1547.011 · Plist ModificationThe RAT established persistence by installing a LaunchAgent that runs at login.T1548.006 · TCC ManipulationThe attack requested Full Disk Access through macOS Transparency, Consent, and Control.T1555.001 · KeychainThe stealer retrieved Chromium Safe Storage AES keys from the login keychain.T1555.003 · Credentials from Web BrowsersMacSync collected secrets from the macOS login keychain.T1656 · ImpersonationThe malware used trojanized wallet apps to solicit cryptocurrency recovery phrases.
People
Jamie LevyHuntress participant who cited BlockBlock and LuLu Firewall as possible detection tools.Josh KiriakoffHuntress SOC analyst who reconstructed and analyzed the MacSync attack chain.Ryan DowdHuntress SOC analyst who discussed the malvertising lure and MacSync kill chain.Susannah MattNamed author of the Huntress article.
Malware
Atomic macOS Stealer (AMOS)to AI-hosted ClickFix instructions: we caught malicious ChatGPT and Grok conversations delivering AMOS Stealer back in 2025, and more recently, a fake Claude Desktop campaign that distributed SectopRAT. But RyanMacSyncHomeBlogHow a Google Search for Claude Led to MacSyncSectopRATAMOS Stealer back in 2025, and more recently, a fake Claude Desktop campaign that distributed SectopRAT. But Ryan noted that this MacSync sample has a more fleshed out kill chain compared to other ClickFix
Vendors
AnthropicClaude on a Mac," the victim clicked on a sponsored Google Ads post. The victim was indeed taken to Anthropic's legitimate claude.ai domain, but to a publicly shared conversation page instead of the officialAppleLooks legit, right? It's even got a badge stating it's been shared by Apple Support. But look closer. While it's a real page hosted on the actual claude.ai domain, this shared conversation instructs you to paste a curlGoogleHomeBlogHow a Google Search for Claude Led to MacSync
Products
ClaudeHomeBlogHow a Google Search for Claude Led to MacSyncClaude CodePicture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps. You type "How to install Claude Code on a Mac" in Google and click on the first link at the top of the page. Google AdsAfter searching for "How to Install Claude on a Mac," the victim clicked on a sponsored Google Ads post. The victim was indeed taken to Anthropic's legitimate claude.ai domain, but to a publicly shared conversation pageLedger Walletrecovery phrases. As an example, Josh walked though how the payload spoofs an error page for the Ledger Wallet app, prompting the user to enter their recovery phrase: macOS(found in the Elastic telemetry), Josh reconstructed the request the loader makes, and using a spoofed macOS User-Agent and a static api-key, pulled that first payload directly from the attacker's servers.