Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps

Gbhackers •Mayura Kathir • August 19, 2026

A Google- result for Claude installation instructions is being used to deliver a sophisticated macOS stealer and remote-access trojan (RAT) named MacSync. The campaign abuses a legitimate Claude shared-conversation page on the claude.ai domain, demonstrating how trusted AI-hosting infrastructure can be weaponized to bypass users’ normal phishing instincts. The intrusion investigated by Huntress began […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MacSync Infostealer Exploits Google Search for Claude Installation A malvertising campaign has emerged, using Google search results for Claude installation to deliver a macOS infostealer named MacSync. Victims are misled to a legitimate claude.ai shared conversation page, where they are instructed to execute a malicious curl command in Terminal. This command downloads the MacSync payload, which includes components like a password stealer and a remote access trojan (RAT). The attack was first identified by Huntress in July 2026, affecting macOS users who searched for installation instructions. The campaign demonstrates the effectiveness of leveraging trusted AI-hosting infrastructure to bypass user skepticism. Huntress analysts noted that this attack has a more developed kill chain compared to previous similar campaigns. Users are advised to be cautious of such misleading search results. 2 sources 68

Extracted Entities

Fake Claude Install Guide Steals Mac Passwords and Turns Trusted Crypto Wallet Apps Into Phishing Traps

The full story

Extracted Entities

Attack Types (3)

Domains (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)