Google Ads push fake Claude downloads on claude.ai that install stealers
macOS ClickFix commands fetch Atomic macOS Stealer; a Windows Artifact runs a packed .NET payload with remote access.
73
Malware
Atomic macOS Stealer
- Mentions · 7d0
- Mentions · 30d2
- All mentions3
- First seenSep 21, 2026
- Last mentioned15d ago
Timeline
3 articles · newest firstFake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
72
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
65
Appears with
- Anthropicvendor · 2
- Gen Digitalorganization · 2
- ADAMnetworksvendor · 1
- Claudeai model · 1
- MacSyncmalware · 1
- HBO Maxvictim · 1
- Googleorganization · 1
- Zoom Workplaceproduct · 1
- Spotifyproduct · 1
- Cato Networksvendor · 1
- Amatera Stealermalware · 1
- HBO Maxproduct · 1
- Hudson Rockvendor · 1
- Blackpointvendor · 1
- ZigClippermalware · 1
- Claudeproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.