MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

MacSync Campaign Turns Claude Search Into a Malware Trap

August 19, 2026: A search for help installing Claude on a Mac is being turned into an entry point for attackers, with a campaign using Google’s sponsored results and a fake support conversation to convince users to execute a malicious Terminal command. The payload, identified as MacSync, is far more invasive than a conventional password stealer. Researchers at Huntress found that the malware can extract browser data and credentials, establish pe…

Hackers Use Fake Claude Install Guide to Deploy MacSync Stealer and Trojanize Crypto Wallet Apps

Mac users searching for help with Claude Code are being lured into a malware campaign that turns a routine installation task into a full device compromise. The operation uses paid Google search results and a convincing shared Claude conversation to persuade victims to run a command in Terminal. The campaign puts everyday Mac users at serious risk. The page is hosted on Claude.ai, which gives the lure an air of legitimacy, but it is not an offici…

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

Picture this: You’ve just unboxed a shiny new Macbook, and now you’re downloading all of your favorite apps. You type “How to install Claude Code on a Mac” in Google and click on the first link at the top of the page.  You’re presented with the following:  Figure 1: A shared Claude conversation you might have been directed to after clicking on a sponsored search result in Google Looks legit, right? It’s even got a badge stating it’s been shared …