Google Ads Campaign Delivers MacSync Through Claude Lures

Reporting on MacSync has documented more than one delivery configuration. Deriv identified a Claude shared-page lure hosted on claude.ai, while Beelzebub Labs research summarized by CybersecurityNews and CyberPress described a related campaign that used sponsored ads leading to a fake Claude Code page on Google Sites.

GBHackers, citing Zscaler Threat Hunting, reported a June 12-19 campaign in which attacker-controlled Claude shared chats were branded as "Shared by Apple Support." According to that report, the malicious chats became inaccessible after Anthropic was alerted. The shared-chat content instructed users to paste a command that retrieved a payload with curl, decoded Base64 data, and piped output to zsh.

These reports describe a common delivery pattern, but they should not be treated as evidence that every Claude-themed ad uses the same infrastructure or payload build. The current Deriv report specifically identifies a claude.ai/share lure, whereas earlier analyses identify Google Sites pages and other shared-chat content.

Deriv characterizes MacSync as a macOS infostealer designed to collect credentials, browser sessions, developer secrets, and cryptocurrency wallet data. Gridinsoft's summary of Beelzebub Labs research lists browser profiles, macOS Keychains, SSH keys, AWS credentials, Kubernetes configuration files, shell history, Telegram sessions, Apple Notes, and wallet extensions among the reported targets.

GBHackers' account of the Zscaler research adds technical detail on the staged execution chain. It reports that the second-stage script suppresses output, retrieves a core payload through a /dynamic?txd= endpoint, executes downloaded content through osascript, packages collected data into /tmp/osalogging.zip, and uploads the archive in chunks. Those implementation details are reported behavior, not an indication that all MacSync samples or campaigns operate identically.

Earlier Beelzebub Labs reporting, as summarized by CyberSecurityNews and CyberPress, also described a fake password prompt and a second stage that modified Ledger application files to collect cryptocurrency recovery phrases. That capability is particularly consequential for affected users, but it is tied to the campaign samples analyzed by those researchers.

The immediate risk is not a vulnerability in Claude Code itself. It is the combination of paid-search placement, legitimate or widely trusted hosting domains, plausible installation documentation, and user-executed shell commands. Deriv reports that the latest lure used legitimate infrastructure specifically to make conventional domain checks less useful.

For security teams, this campaign illustrates a broader pattern in which software-install instructions become the attack surface. Organizations that support developer workstations commonly treat pasted shell commands, cloud credentials, SSH keys, browser sessions, and wallet extensions as distinct detection and response concerns. The reported MacSync collection set combines several of those assets in one endpoint compromise, increasing the value of monitoring unexpected shell execution and outbound archive uploads from developer Macs.

Users seeking Claude Code should obtain installation commands from Anthropic's official documentation rather than sponsored search results or shared pages. Anyone who executed a suspicious command should treat stored browser sessions, developer credentials, SSH keys, cloud keys, and cryptocurrency wallet data as potentially exposed, based on the capabilities reported by the cited researchers.