Fake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
72
- Mentions · 7d1
- Mentions · 30d2
- All mentions7
- First seenAug 19, 2026
- Last mentioned3d ago
Timeline
7 articles · newest firstFake Apex Accelerator npm packages spread stealers and backdoors
@apexacc/cli and @apexacc/audit promised AI credits and audits but delivered Windows and macOS malware instead.
74
MacSync’s New Infection Chain Shows How Mac Malware Is Becoming More Sophisticated
Kaspersky reports MacSync’s new macOS chain uses native loaders, iCloud staging, an infostealer, and a persistent backdoor.
74
MacSync malware uses public iCloud calendars to deliver new payloads
MacSync macOS infostealer now pulls new payloads from public iCloud calendar events and adds a persistent backdoor.
61
ChatGPT Computer History Feature Creates New Attack Surface for macOS Infostealers
OpenAI's new ChatGPT 'Computer History' feature for macOS logs user actions in unencrypted text, creating a high-value target for infostealers.
75
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.
50
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.
42
Appears with
- MacSyncmalware · 3
- Claudeproduct · 2
- Huntressvendor · 2
- Applevendor · 2
- Kasperskyorganization · 2
- Kasperskyvendor · 2
- macOSproduct · 2
- Google Docsproduct · 2
- NetSupport Managerproduct · 1
- Gemini 2.5 Flashai model · 1
- npmvendor · 1
- ChatGPT Desktop Appproduct · 1
- OpenAIorganization · 1
- ChatGPTai model · 1
- SafeDeporganization · 1
- Gen Digitalorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.