MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads

Gbhackers •Divya • July 1, 2026

MacSync Stealer is a newly discovered macOS infostealer actively distributed through a sophisticated malvertising campaign on Google Ads that impersonates Anthropic’s Claude Code CLI. Security researchers from Beezlebub have uncovered the complete attack chain, revealing a multi-stage infection process that spans from social engineering to deep system compromise, credential harvesting, and persistent hijacking of crypto […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

MacSync Stealer Targets macOS via Malicious Google Ads Campaign The MacSync Stealer, a newly identified macOS infostealer, is being distributed through a sophisticated malvertising campaign on Google Ads that mimics Anthropic’s Claude Code CLI. Security researchers from Beezlebub Labs have detailed a multi-stage infection process that includes social engineering, credential harvesting, and persistent hijacking of cryptocurrency wallets. The malware not only steals credentials but also compromises Ledger Live and Ledger Wallet applications to extract crypto seed phrases. This campaign poses a significant risk to macOS users, particularly those involved in cryptocurrency transactions. The full scope of the attack and the number of affected users is still under investigation. The researchers utilized their threat-intel platform Caronte to reverse-engineer the malware and understand its operation. As of now, the campaign remains active, and users are advised to exercise caution when interacting with ads related to Claude Code. 9 sources 65

Extracted Entities

MacSync Stealer Hijacks macOS via Fake Claude Code Google Ads

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)