Zscaler Finds Attackers Abusing Claude AI Shared Chats To Distribute Mac Malware Via ClickFix Technique

Zscaler Threat Hunting has identified a campaign in which attackers abused Anthropic’s Claude platform to distribute malware to macOS users, using shared Claude chats to host malicious ClickFix instructions that appeared to come from Apple Support.

The campaign relied on Google search advertising to direct people searching for Claude-related terms to shared Claude chats containing instructions that, when followed, installed MacSync Stealer – malware capable of stealing credentials, browser data, sensitive files and cryptocurrency wallet information.

Zscaler notified Anthropic about the misuse and the malicious shared chats were no longer accessible at the time the research was published.

What Is ClickFix

ClickFix is an attack technique first observed in 2024 in which victims are instructed to paste and run commands on their system to “fix” a problem or install software. The commands appear benign but are malicious and lead to malware deployment.

In this campaign, the attackers shifted the hosting of ClickFix instructions from the more typical compromised websites or fake software download pages to shared Claude chats – a legitimate feature of Anthropic’s AI platform that allows users to share conversation threads via a public URL. By hosting instructions on a legitimate domain, the attackers added a layer of credibility that a standalone malicious site would not provide.

Ruchna Nigam, Principal Security Researcher at Zscaler, pointed to the trust factor as the central element.

“Cybercriminals are always looking for new ways to earn users’ trust. In this Claude campaign, attackers used a legitimate AI platform to make their malicious instructions appear credible,” Nigam explained. “As AI tools become more popular and widely used, we expect threat actors to continue exploiting trusted platforms and services as part of their social engineering and malware attacks.”

How The Attack Began

The attack chain started with a victim searching for a term such as “claude download” in a search engine. A paid ad in the results pointed to a shared Claude chat link on the legitimate claude.ai domain. From the outset, the use of Claude’s official domain added credibility to the search result.

The shared chat was labelled “Shared by Apple Support” in the interface. The attackers achieved this by setting their Claude display name to “Apple Support”, which caused this label to appear when the shareable link was generated.

The chat instructed the user to run a curl command with the destination URL obfuscated using Base64 encoding. The command downloaded and executed a Z shell (zsh) script that initiated a multi-stage infection chain.

Malvertising Campaign

Zscaler observed seven unique search terms targeted by the malvertising campaign: “claude”, “claude ai”, “claude code”, “claude mac”, “ai claude”, “claude code desktop mac” and a Chinese-language term for “client.” Twenty-two unique campaign IDs were identified across the operation. The source of the ad links was consistently Google.

Based on Zscaler’s analysis of traffic logs across its customer base, the campaign appeared to be short-lived, running from 12 to 19 June 2026.

Multi-Stage Infection Chain

The infection progressed through several stages, each designed to reduce visibility to security tools.

The first-stage zsh script contained a blob that was Base64-decoded then decompressed using gzip to reveal a second-stage script. This second stage redirected all output to /dev/null, hiding visible signs of execution, then downloaded the third stage containing the core stealing functionality. The downloaded content was piped directly to osascript, leaving no file trace on the affected system.

The second-stage VBS scripts followed the same naming convention as the ZIP archives and HTML lures used earlier in the chain, maintaining the appearance of legitimate financial documents. The sample analysed was approximately 7 MB despite containing only around 22 KB of actual code. The remainder consisted of junk variables, unnecessary functions and encoded strings designed to inflate the file and evade signature-based detection.

The researchers assessed with moderate confidence that the campaign’s infrastructure employed geofencing or victim-tracking mechanisms to restrict payload delivery, making it difficult to obtain next-stage payloads outside of a live infection chain.

What MacSync Stealer Takes

The third stage of the malware, spanning approximately 1,000 lines of deobfuscated code, has broad data theft capabilities.

It copies all keychain files from the user’s system and targets browser data across 13 Chromium-based browsers including Chrome, Brave, Edge, Vivaldi, Opera, Arc and Yandex. Four Gecko-based browsers are also targeted, including Firefox, Zen, LibreWolf and Waterfox. The malware searches for dozens of browser extensions used as password managers and cryptocurrency wallets.

The malware collects shell configuration and history files, SSH and cloud keys, Telegram application files and files from the user’s Downloads, Documents and Desktop directories matching extensions including pdf, docx, wallet, key, seed and kdbx. It also targets Safari cookies, autofill data, history artefacts and Apple Notes files.

A fake macOS prompt tricks the victim into entering their system password. The malware gathers system fingerprinting information including software, hardware and graphics data, then sends a Base64-encoded beacon containing host information and antivirus product details to the C2 infrastructure.

Cryptocurrency Targeting

The malware targets a wide range of cryptocurrency assets. It searches for Chromium extensions associated with crypto wallets, copying local files for processing. Desktop wallet application folders are also targeted, covering applications including Exodus, Electrum, Atomic Wallet, Guarda, Coinomi, Sparrow, Bitcoin, Ledger Live, Trezor and others.

If the applications Ledger Wallet, Ledger Live or Trezor Suite are present on the affected system, the malware attempts to download additional payloads from the attacker’s infrastructure. These could not be retrieved at the time of analysis, but Zscaler assesses they are likely trojanised versions of the legitimate applications.

Persistence

If the malware cannot access the user’s cookies directory on first run, it modifies the shell configuration file to append a command that redownloads and executes the malware each time the terminal is opened. It also prompts the user to grant full disk access through a fake dialogue that opens the Security and Privacy settings pane.

Once full access is obtained, the persistence mechanism is removed and the malware proceeds with data collection. Collected data is compressed and exfiltrated in 10 MB chunks via HTTP PUT requests, with each chunk retried up to eight times on failure. After exfiltration, the malware deletes its archive and working directory from the system.

Attribution Indicators

Zscaler found Russian-language comments in the third-stage AppleScript payload, suggesting the threat actor is likely Russian-speaking. Comments included references to copying files and removing a function that frequently crashed when Firefox was running.

The malicious domains used in the campaign adopted names themed around local services in US cities. Examples included realtorsmichigan.com, syracusefertilitycenter.com, lasvegaslaminateflooring.com, dogtrainersgeorgia.com, chicagometalscrap.com, miamipcsupport.com, newjerseypetsitter.com, homeinspectionsdelaware.com and cabinrentalsnc.com.

Zscaler has published a full list of indicators of compromise including staging URLs, hosting domains and infrastructure details.

Shift In Distribution

The research notes that the threat actor behind MacSync Stealer has shifted distribution from fake “cracked” applications to the ClickFix technique, reflecting a broader trend across the threat landscape. The abuse of a legitimate AI platform feature to host the malicious content represents a further evolution, as it allows attackers to benefit from the trust users place in established services without needing to compromise the platform itself.

Last Updated on July 21, 2026 by Nick Ross