A Mac user who searched Google for how to install Claude Code clicked the top result, a paid ad, and landed on a step-by-step guide hosted on claude.ai itself. It told them to open Terminal and paste one command. That command installed MacSync, a six-stage macOS stealer and remote access trojan that security firm Huntress took apart in a detailed write-up.
The lure needed almost no forgery. Anthropic lets any user publish a conversation to a public share URL, so the page sat on claude.ai over HTTPS under Anthropic’s own certificate. The operator set their display name to “Apple Support,” and Anthropic’s safety banner above the content read “This is a copy of a chat between Claude and Apple Support.” The guide promised the install “leaves your personal files untouched” and “makes no system-level modifications without your approval.”
Six stages
The pasted line hid its URL in a Base64 string. Decoded, it fetched a 1,442-byte zsh loader from agenticsora[.]com, one of two Cloudflare-fronted delivery domains Huntress tied to the kit. “MacSync is a six-stage kill chain, not a smash-and-grab,” Huntress researcher Josh Kiriakoff wrote.
The stealer itself is served from the attacker’s server behind an API key, so the valuable logic stays off the endpoint. It walks the user into granting Full Disk Access, checks the account password they type with dscl . authonly, and pulls Chromium “Safe Storage” keys from the login keychain to unlock browser data. It also collects Telegram sessions, SSH and cloud keys, roughly 60 wallet browser extensions and about 21 desktop wallet apps, packing the haul into /tmp/osalogging.zip for upload.
Next comes a native C++ remote access trojan, ad-hoc signed with no Team ID and persisted through a LaunchAgent, which talks to a raw IP on port 8443 using WebSocket messages wrapped in AES-256-CBC. A separately signed helper exists only to win the Screen Recording permission and then shells out to screencapture.
The wallet trap
The last stage is what sets MacSync apart, Huntress said. If Ledger Live, Ledger Wallet or Trezor Suite is installed, the malware rewrites the app in place. A normal launch then shows a fake error and a recovery form asking for the 24-word seed phrase, which is posted to an attacker-controlled host. “A stealer that copies a wallet directory still needs the wallet’s password, whereas MacSync waits for the victim to type the recovery phrase into what appears to be their own Ledger,” the researchers wrote.
The victim took the Mac offline before Huntress could pull the malware from disk, so the researchers rebuilt the loader’s request and downloaded every stage from the attacker’s own servers.
Huntress has documented the same delivery pattern before, with AMOS Stealer spread through poisoned ChatGPT and Grok conversations and SectopRAT through fake Claude desktop ads, TechRadar noted. The common step in each case is a user pasting a command from a search result into Terminal.
WebProNews is an iEntry Publication