Back Letsdatascience

Threat Actors Use Claude Chats to Deliver macOS Malware | Let's Data Science

Letsdatascience • May 11, 2026

Security researchers report a malvertising campaign that uses paid Google ads and publicly shared Claude chats to trick macOS users into running malware. According to BleepingComputer, researcher Berk Albayrak posted findings on on May 10 showing shared Claude conversations that present a fake "Claude Code on Mac" installer and instruct users to paste Terminal commands that download and execute a compressed, in-memory loader script. ITSecurityNews reports the campaign delivered a variant linked to MacSync and BleepingComputer reported distinct obfuscated payloads from domains such as customroofingcontractors[.]com and bernasibutuwqu2[.]com. Hackread and Oasis Security reporting describe related research into "Claudy Day" flaws, including hidden prompt injection and open-redirect techniques that can make malicious links appear to originate from claude.ai . Editorial analysis: This operation illustrates how attackers combine trusted platforms and ads to increase credibility, complicating detection and user education for macOS defenders.

Security reporting shows a malvertising campaign leveraging paid Google results and public Claude shared chats to distribute macOS malware. According to BleepingComputer, researcher Berk Albayrak shared findings on on May 10 identifying a shared Claude chat that posed as an official "Claude Code on Mac" installation guide and instructed users to paste a Terminal command that silently fetched and ran code (BleepingComputer). ITSecurityNews reports the same campaign distributes a variant associated with MacSync (ITSecurityNews). Hackread and Oasis Security coverage frames related research as "Claudy Day," describing techniques for embedding hidden instructions and abusing open redirects on claude.ai to get malicious links approved as ads (Hackread).

BleepingComputer documented that the shared chat content included base64-encoded commands that retrieve a loader.sh script from domains such as hxxp://customroofingcontractors[.]com and hxxps://bernasibutuwqu2[.]com/debug/loader.sh?build=... (BleepingComputer). The observed loader.sh is a Gunzip-compressed shell script that runs primarily in memory, reducing disk artifacts, and the reporting notes the server returned uniquely obfuscated payload contents per request to evade signature-based detection (BleepingComputer). BleepingComputer also observed behavioral checks in one variant, including a keyboard-layout check to avoid Russian and CIS-region victims (BleepingComputer).

Attack chains that combine malvertising with prefilled or shared AI chat content exploit two trust vectors: -ad ranking and the perceived legitimacy of platform-hosted artifacts. For practitioners, in-memory compressed loaders and per-request obfuscation increase the value of runtime detection and network telemetry over static file scanning.

Industry reporting highlights two complementary enablers for this campaign. First, paid Google ads can point users to domains that mimic legitimate services; BleepingComputer documents results for queries like "Claude mac download" linking to malicious instructions (BleepingComputer). Second, Oasis Security research summarized by Hackread shows how hidden prompt injection and open-redirect patterns can be chained to make malicious content appear to originate from claude.ai and bypass user suspicion (Hackread). Together, these factors let attackers craft highly credible social engineering content that leads to single-command execution on macOS.

Observers should track:

Monitor DNS and outbound connections to the domains named in reporting, instrument Terminal command launches and child process creation on macOS endpoints, and prioritize runtime telemetry that can detect compressed, in-memory shell stages and per-request payload obfuscation.

The campaign uses widely trusted channels ( ads and public AI chat artifacts) to deliver a macOS infostealer, increasing operational credibility and detection difficulty. It is notable for defenders but not a paradigm-shifting vulnerability.

Practice with real Ad Tech data

90 SQL & Python problems · 15 industry datasets

250 free problems · No credit card

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

InstallFix Campaign Exploits AI Trust to Deliver Malware via Fake Install Pages The InstallFix campaign targets users by creating fake installation pages for Anthropic's Claude AI, tricking them into executing malware. This sophisticated social engineering tactic exploits the growing reliance on AI tools, affecting both developers and non-technical users. The malware, primarily the Amatera Stealer, collects sensitive information and establishes persistence on compromised systems. Attackers use Google Ads to promote these malicious pages, which mimic legitimate installation commands. The campaign has been observed impacting users on both Windows and macOS platforms. Security researchers have identified the use of PowerShell and MSHTA to execute malicious commands. The threat landscape is evolving as attackers leverage common developer habits, increasing the risk of infection. Organizations are urged to remain vigilant against these deceptive tactics. 53 sources 70

Extracted Entities

Threat Actors Use Claude Chats to Deliver macOS Malware | Let's Data Science

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Domains (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (1)

Tools (1)