MacSync Malware Campaign Targets macOS Users with Fake Claude Guides, Stealing Passwords and Crypto Wallets

A sophisticated new malware campaign, dubbed MacSync, is actively targeting macOS users, posing a significant threat to personal data and cryptocurrency holdings. Cybersecurity researchers have uncovered how attackers are exploiting the growing interest in AI tools, specifically Claude, by luring unsuspecting users into downloading malicious software disguised as legitimate installation guides.

The campaign initiates when users search for assistance installing AI applications like Claude. Attackers have reportedly leveraged paid search results to direct victims to deceptive content. This leads users to a fabricated guide hosted on what appears to be a legitimate Claude sharing page, lending an air of credibility to the malicious instructions.

The fake guide then persuades users to execute a specific command in their macOS Terminal. This seemingly innocuous step is, in fact, the critical juncture where the MacSync stealer is deployed onto the victim's system. Executing unknown commands in Terminal is a high-risk action that bypasses many standard security protocols, allowing malware to gain deep system access.