# MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Malvertising via a shared claude.ai conversation lured a macOS user into pasting a curl|zsh ClickFix command, installing the MacSync infostealer and RAT.

- Payout: Real-world hack
- Severity: high
- Program: MacSync
- Analysis by: Huntress
- Disclosed: 2026-08-17
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/fake-claude-macsync
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-fake-claude-macsync
- Tags: area:os domain:desktop impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:curl technique:chained technique:reverse-engineering technique:source-review vuln:secrets-leak

**Target:** macOS endpoint (Terminal/zsh, TCC, keychain, browser Safe Storage, crypto wallets)
**Root cause:** Attacker-controlled shared conversation on the legitimate claude.ai domain, reached via a sponsored Google ad, instructs the victim to paste a curl one-liner into Terminal; the polymorphic zsh loader then fetches server-generated AppleScript that abuses user-granted TCC permissions.
**Steps:**
1. Victim searches "How to install Claude Code on a Mac" and clicks a sponsored Google Ads result pointing to a shared claude.ai conversation displayed as "Apple Support".
2. Page uses ClickFix to instruct pasting a `curl` command with a zsh loader into Terminal.
3. Stage 1: curl returns a 1,442-byte zsh wrapper around a gzip+Base64 heredoc payload (polymorphic per victim token).
4. Stage 2: `daemon_function` runs in background, executes stage 3 AppleScript in-memory, uploads `/tmp/osalogging.zip`, removes staging file.
5. Stage 3: server-generated osascript requests Full Disk Access via TCC prompt; after approval Terminal restarts with elevated perms and `.zshrc` installs persistence; victim is prompted for password.
6. Stage 3 extracts Chromium "Safe Storage" AES keys and passwords from login keychain, decrypts cookies/logins/web data, writes creds to `.mpwd`, installs Mach-O RAT in Home folder.
7. Stage 4: RAT creates plist named after first updater found and LaunchAgent for login persistence; C2 to `85.206.161.241:8443` over WebSocket/TLS with embedded OpenSSL; XOR 0xAA-obfuscated fallback domain.
8. Stage 5: separately signed capture agent requests Screen Recording TCC; modes `--tcc-only` and `-o <path>` write screenshots to disk for RAT upload.
9. Stage 6: copies/rewrites/replaces 60 wallet browser extensions, 21 desktop wallet apps, and 3 hardware wallet companion apps; spoofed Ledger error page phishes recovery phrase.
**How found:** Huntress responded to a customer incident where the user shut down the device; analysts pivoted off the curl command in Elastic telemetry, reconstructed the loader request with a spoofed macOS User-Agent and static api-key, and pulled the payload directly from attacker servers for reverse engineering.
**Exploitation:** End-to-end: sponsored ad → shared claude.ai page → ClickFix curl|zsh → in-memory AppleScript stealer with TCC Full Disk Access → keychain/browser credential and cookie theft → persistent Mach-O RAT with interactive shell and file transfer → signed helper for Screen Recording → trojanized wallet apps to phish seed phrases, giving irreversible control of all wallets derived from the seed.
**Escalation:** Chained social engineering (fake Apple Support branding, ClickFix) with TCC permission abuse, then layered persistence (LaunchAgent + dual C2 channels) and wallet-app trojanization to escalate from credential theft to crypto fund loss.
**Insight:** Legitimate AI chat-share domains (claude.ai, ChatGPT, Grok) can host attacker-controlled ClickFix instructions that survive URL reputation checks; pivot off curl commands in EDR telemetry and replay the request with the malware's own User-Agent and api-key to retrieve server-side payloads for analysis.