MacSync Infostealer Exploits Google Search for Claude Installation

A malvertising campaign has emerged, using Google search results for Claude installation to deliver a macOS infostealer named MacSync. Victims are misled to a legitimate claude.ai shared conversation page, where they are instructed to execute a malicious curl command in Terminal. This command downloads the MacSync payload, which includes components like a password stealer and a remote access trojan (RAT). The attack was first identified by Huntress in July 2026, affecting macOS users who searched for installation instructions. The campaign demonstrates the effectiveness of leveraging trusted AI-hosting infrastructure to bypass user skepticism. Huntress analysts noted that this attack has a more developed kill chain compared to previous similar campaigns. Users are advised to be cautious of such misleading search results.

Key Points: • Malicious Google search results for Claude installation lead to MacSync infostealer. • Attackers exploit a legitimate claude.ai page to deliver malware via a curl command. • Huntress confirmed the attack's sophistication and detailed its six-step kill chain.