TLDR Tech / InfoSec
Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker's Servers
Huntress traced a malvertising chain that walked a victim from a poisoned Google ad through a weaponized claude.ai/share page into a curl|zsh loader, unfolding into a six-stage macOS kill chain that phished Full Disk Access and a confirmed account password, then dropped a native Mach-O RAT, a signed Screen Recording helper, and trojanized Ledger/Trezor wallet apps rewritten in place to phish BIP39 recovery phrases. The tradecraft resembles the AMOS/Atomic Stealer lineage based on shared techniques and Russian-language code comments, which Huntress frames as a family resemblance rather than named-actor attribution. Defenders should hunt behaviorally for curl -k piped into zsh, a com.apple.* LaunchAgent paired with a ~/.local/.mpwd file, and ad-hoc-signed apps whose ElectronAsarIntegrity hash doesn't match the shipped app.asar.
Read the full story