Fake Claude Code

Overview

Cybersecurity researchers have uncovered a malvertising campaign that abuses Google Ads to push a fake Claude Code installation guide, ultimately delivering the MacSync infostealer to macOS users. This attack highlights how trusted brand signals and familiar developer workflows can be weaponized to steal credentials, developer tokens, and cryptocurrency wallet data.

Attack Flow

1. Search manipulation: Users searching for Claude Code installation help encounter a sponsored Google Ad.
2. Fake Claude share page: The ad redirects to a Claude.ai share page disguised as an installation guide, falsely labeled as shared by “Apple Support.”
3. Encoded payload: The guide instructs users to run a terminal command that hides its true destination using Base64 encoding.
4. Payload delivery: Once decoded, the command downloads MacSync from attacker infrastructure, bypassing certificate validation with curl -k.
5. Persistence: MacSync establishes persistence via a LaunchAgent masquerading as a Google Keystone updater.

What MacSync Steals

• macOS Keychain data — stored passwords and certificates.
• Browser sessions — cookies and saved credentials.
• Developer credentials — SSH keys, cloud tokens, Kubernetes settings.
• Cryptocurrency wallets — over 80 wallets, including Ledger Live modifications.
• Telegram sessions — enabling account takeover.

Indicators of Compromise (IoCs)

Security teams should watch for:

• C2 domains: hybridcustomhomes[.]com, houstongaragedoorinstallers[.]com, mansfieldpediatrics[.]com.
• C2 IPs: 104.21.40.24, 172.67.174.150.
• Payload hashes: ae89034f81cb488b67a27ebe66e21a5a60098a6dc7271dd18be883bf221b02bf, da59496b565f5ea96a26b5b0fd05df44b2d3d6acc0f971a88015a447b6d6608826.
• Persistence file: Library/LaunchAgents/com.google.keystone.agent.plist.
• Staging artifacts: tmp.c.sh, tmp.zip.

Defensive Guidance

• Avoid sponsored results when searching for developer tools.
• Inspect terminal commands — decode Base64 text and reject commands that disable certificate checks.
• Isolate compromised Macs immediately; do not use them for recovery.
• Rotate credentials — passwords, SSH keys, cloud tokens.
• Revoke sessions — browser, developer, and CI/CD accounts.
• Move cryptocurrency to new wallets.
• Reimage affected devices to ensure persistence mechanisms are removed.

Expert in the Cloud Insight

This campaign demonstrates how search ads are becoming the new phishing emails. By exploiting trust in Claude.ai and Apple branding, attackers bypass traditional red flags and lure developers into executing malicious commands. For enterprises, the takeaway is clear: malvertising is now a frontline threat vector. Security awareness must extend beyond email to include search hygiene, command inspection, and strict validation of installation sources.