--- title: MacSync Stealer: How a Google Search for Claude Led to a... description: A malvertising campaign spreads a macOS infostealer called MacSync via sponsored Google search results that lead to a legitimately hosted claude.ai shared... canonical: https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer | daily.dev og:description: A malvertising campaign spreads a macOS infostealer called MacSync via sponsored Google search results that lead to a legitimately hosted claude.ai shared... og:url: https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj og:image: https://api.daily.dev/og/posts/rQ1vl8kjj.png og:image:alt: MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary A malvertising campaign spreads a macOS infostealer called MacSync via sponsored Google search results that lead to a legitimately hosted claude.ai shared conversation page impersonating Apple Support. The page uses a ClickFix technique to trick victims into pasting a curl command into Terminal, triggering a six-stage attack chain: a zsh loader, in-memory payload execution, a server-generated AppleScript stealer, a Mach-O remote access trojan, a helper for stealing Screen Recording TCC permissions, and trojanized crypto wallet apps. The malware harvests browser cookies, keychain secrets, SSH/cloud keys, Telegram sessions, and crypto recovery phrases, while using C2 over WebSocket/TLS and XOR-obfuscated fallback domains for persistence. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is MacSync Stealer and how does it infect a Mac? MacSync Stealer is a macOS infostealer and RAT distributed through sponsored Google search ads that lead to a legitimate claude.ai shared conversation page spoofed with an 'Apple Support' badge. The page instructs victims to paste a curl one-liner into Terminal, kicking off a six-stage chain that steals browser cookies, keychain secrets, SSH keys, Telegram sessions, and crypto wallet recovery phrases while installing a persistent Mach-O RAT. _Track emerging macOS malware campaigns like this on daily.dev before pasting unfamiliar terminal commands._ ### How can I detect a polymorphic zsh loader used in ClickFix malware attacks? Because each build of the loader changes based on a victim-specific token, hash-based detection fails; instead, detection should target behavior such as curl commands paired with Base64-encoded content executed in shell. The MacSync loader is a tiny 1,442-byte three-line zsh wrapper around a gzip-compressed, Base64-encoded heredoc payload that decompresses and runs in memory. _Security engineers building behavioral detections for shell-based malware can follow analysis like this via daily.dev._ ### Why is losing a crypto wallet recovery phrase worse than losing passwords or cookies? Passwords and cookies can be rotated, reset, or expired, but a wallet recovery phrase cannot be revoked once exposed. Anyone who obtains the seed phrase controls every wallet derived from it permanently, with no way to reset access, unlike browser credentials which sessions can invalidate. _Developers building or securing crypto wallet apps can stay on top of phishing techniques like this through daily.dev._ ## Similar posts on daily.dev - [Reverse Engineering the Six Stages of MacSync Stealer and RAT](https://daily.dev/posts/reverse-engineering-the-six-stages-of-macsync-stealer-and-rat-dlt3btljo) · Huntress Blog · 0 upvotes · 0 comments - [MacSync Stealer malware bypasses macOS Gatekeeper security warnings](https://daily.dev/posts/macsync-stealer-malware-bypasses-macos-gatekeeper-security-warnings-rrvsdbo2x) · CSO Online · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware), [#mac](https://daily.dev/tags/mac) [View this post on daily.dev](https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer","url":"https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj"},"datePublished":"2026-08-18T16:16:34.309Z","dateModified":"2026-09-14T09:13:11.725Z","description":"A malvertising campaign spreads a macOS infostealer called MacSync via sponsored Google search results that lead to a legitimately hosted claude.ai shared...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/941dbb0d39c587c0fce37d74ad1b5b65?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/941dbb0d39c587c0fce37d74ad1b5b65?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Huntress Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Huntress Blog","logo":"https://media.daily.dev/image/upload/s--kDC1MDsj--/f_auto,q_auto/v1780213277/logos/huntress-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/huntress-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"malware,mac","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Huntress Blog","item":"https://daily.dev/sources/huntress-blog"},{"@type":"ListItem","position":3,"name":"MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/macsync-stealer-how-a-google-search-for-claude-led-to-a-macos-infostealer-rq1vl8kjj#faq","mainEntity":[{"@type":"Question","name":"What is MacSync Stealer and how does it infect a Mac?","acceptedAnswer":{"@type":"Answer","text":"MacSync Stealer is a macOS infostealer and RAT distributed through sponsored Google search ads that lead to a legitimate claude.ai shared conversation page spoofed with an 'Apple Support' badge. The page instructs victims to paste a curl one-liner into Terminal, kicking off a six-stage chain that steals browser cookies, keychain secrets, SSH keys, Telegram sessions, and crypto wallet recovery phrases while installing a persistent Mach-O RAT. Track emerging macOS malware campaigns like this on daily.dev before pasting unfamiliar terminal commands."}},{"@type":"Question","name":"How can I detect a polymorphic zsh loader used in ClickFix malware attacks?","acceptedAnswer":{"@type":"Answer","text":"Because each build of the loader changes based on a victim-specific token, hash-based detection fails; instead, detection should target behavior such as curl commands paired with Base64-encoded content executed in shell. The MacSync loader is a tiny 1,442-byte three-line zsh wrapper around a gzip-compressed, Base64-encoded heredoc payload that decompresses and runs in memory. Security engineers building behavioral detections for shell-based malware can follow analysis like this via daily.dev."}},{"@type":"Question","name":"Why is losing a crypto wallet recovery phrase worse than losing passwords or cookies?","acceptedAnswer":{"@type":"Answer","text":"Passwords and cookies can be rotated, reset, or expired, but a wallet recovery phrase cannot be revoked once exposed. Anyone who obtains the seed phrase controls every wallet derived from it permanently, with no way to reset access, unlike browser credentials which sessions can invalidate. Developers building or securing crypto wallet apps can stay on top of phishing techniques like this through daily.dev."}}]} ```