Loading story…
Researchers detailed a macOS malware campaign using ClickFix-style malvertising and fake Claude download lures to deploy MacSync Stealer, an infostealer built to harvest trusted local artifacts rather than rely only on stolen passwords. Victims were redirected from Google ads to spoofed shared Claude chat pages, then tricked into running a Base64-obfuscated shell command that launched multi-stage shell and AppleScript payloads. The malware collected Keychain data, browser credentials, password-manager and wallet extension data, Telegram files, shell histories, cloud keys, Apple Notes content, and selected documents, while also prompting for the macOS password and Full Disk Access; if blocked, it added persistence through ~/.zshrc so it could retry on the next Terminal launch.
The theft enabled direct account and asset compromise. SlowMist found the malware could restore stolen Telegram Desktop and Telegram for macOS session files on another Mac without triggering phone verification or Telegram two-step verification because it reused an already authorized local session. It also targeted 16 wallet applications and 223 wallet-related browser extension IDs, harvesting candidate passwords from multiple sources to decrypt wallet data offline. In a more active phase, the malware removed legitimate Ledger and Trezor apps and replaced them with malicious WebView loaders that displayed attacker-controlled phishing pages to capture recovery phrases. Investigators linked the campaign to multiple malicious domains and Google ad campaign IDs, and published IOCs including IP addresses, URLs, and SHA-256 hashes.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
After being notified about abuse of Claude's shared chat feature in the MacSync Stealer campaign, Anthropic removed the malicious shared chat pages. The article states Claude itself was not compromised and that attackers had only abused legitimate sharing functionality.
SlowMist published an analysis describing a macOS information-stealing malware campaign that abuses local trust artifacts to take over Telegram accounts and compromise cryptocurrency wallets. The report said the malware could restore stolen Telegram sessions on another Mac without triggering phone or two-step verification, target wallet apps and extensions, replace Ledger and Trezor apps with phishing loaders, and included IOCs such as IPs, URLs, and SHA-256 hashes.
Zscaler Threat Hunting observed a ClickFix-style campaign from June 12 to June 19, 2026, in which Google ads impersonating Claude downloads redirected macOS users to shared Claude chat pages and delivered MacSync Stealer. The campaign used staged shell and AppleScript payloads, targeted credentials, wallets, Telegram data, and documents, and used persistence when initial access failed.
A SANS ISC diary reported that fake Claude download pages promoted via malicious Google search ads delivered different payloads by operating system. In a Windows infection chain observed on 2026-05-25, the activity led through multiple download domains and appeared to result in ACR Stealer based on post-infection command-and-control traffic; the report included IOCs and file hashes.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceslowmist.medium.com
Open sourcezscaler.com
Open sourceisc.sans.edu
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported a **macOS infostealer** dubbed **MacSync** being distributed as a low-cost **Malware-as-a-Service (MaaS)**, primarily targeting **cryptocurrency users** via a *ClickFix*-style social engineering lure. The campaign uses phishing infrastructure (including domains mimicking **Microsoft login** pages) to redirect victims to a fake macOS *cloud storage installer* site that instructs users to “install” by copying and pasting a **single Terminal command**. This approach relies on user execution rather than a signed app package, allowing the infection chain to **bypass macOS protections** such as **Gatekeeper** and **notarization**. Technical analysis describes a **script-based, multi-stage** infection chain: the pasted one-liner fetches a remote script that installs a **daemonized Zsh loader** which detaches from the Terminal session and runs in the background, then retrieves additional payloads (including **AppleScript**) to perform data theft. Beyond credential and wallet data harvesting, reporting indicates MacSync can **persist and expand impact** by **trojanizing Electron-based cryptocurrency applications** (e.g., *Ledger Live* and *Trezor Suite*) by overwriting components to present convincing phishing flows designed to capture **PINs** and **recovery phrases**, potentially triggering theft well after the initial compromise.
Jun 29, 2026
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Jun 29, 2026
Researchers reported **three ClickFix campaigns** that used social engineering rather than software exploitation to infect **macOS** users with the **MacSync** infostealer. The activity evolved over several months, beginning with fake sponsored search results for an **OpenAI Atlas** browser download hosted on fraudulent pages, then shifting to malicious workflows that abused shared **ChatGPT** conversations and GitHub-themed landing pages to make the infection chain appear legitimate. In each case, victims were instructed to open **Terminal** and paste commands, allowing the malware to be installed through user action instead of a traditional exploit. The most recent campaign introduced a more advanced **MacSync** variant with **multi-stage loaders**, **dynamic AppleScript payloads**, and **in-memory execution** intended to improve evasion and persistence. Reporting indicates the later activity targeted users in **Belgium, India, and parts of North and South America**, while researchers said it remains unclear whether all three campaigns were conducted by the same threat actor. The findings underscore a broader trend of attackers adapting **ClickFix** lures for macOS, using trusted platforms, sponsored links, and fake AI-tool installers to steal credentials and other sensitive data while bypassing file-based defenses by persuading users to execute the attack themselves.
Jul 3, 2026