MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Picture this: You've just unboxed a shiny new Macbook, and now you're downloading all of your favorite apps. You type "How to install Claude Code on a Mac" in Google and click on the first link at the top of the page. 

Figure 1: A shared Claude conversation you might have been directed to after clicking on a sponsored search result in Google

Looks legit, right? It's even got a badge stating it's been shared by Apple Support. But look closer. While it's a real page hosted on the actual claude.ai domain, this shared conversation instructs you to paste a curl one-liner into Terminal that ultimately downloads a pernicious infostealer. Instead of Claude, you get MacSync. 

When a Huntress customer fell for this malvertising campaign back in July, they instinctively shut down their device when things started to look fishy. Normally, this would prevent our Security Operations Center (SOC) from analyzing certain artifacts from the attack after responding to it. But we found a way to cut out the middle man and pulled a malware sample directly from the attacker's servers. 

Huntress SOC Analysts Ryan Dowd and Josh Kiriakoff walked through the malvertising lure as well as all six stages of the MacSync kill chain in this month's edition of Tradecraft Tuesday. Read their blog for full technical details and check out highlights from the episode below. 

Sponsored search results aren't always just annoying ads