MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer
Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.
Huntress SOC analysts published a reverse-engineering analysis of MacSync Stealer, a macOS infostealer distributed through fraudulent Claude Code download pages surfaced via web searches. Users searching for Anthropic's Claude coding tool are redirected to fake download pages that install the stealer, abusing developer trust in popular AI tooling. The writeup covers the analysis of the sample and its delivery chain.
- Delivered via fake Claude Code download pages found through web searches
- macOS infostealer dissected by Huntress SOC reverse engineering
- Attackers abuse developer trust in popular AI coding tools
- Vendors
- Huntress
- Products
- Claude Code
- Malware
- MacSync Stealer
- AI models
- Claude
From the original article
Huntress SOC analysts reverse engineer MacSync Stealer, a macOS infostealer spread through fake Claude Code download pages. Watch the full analysis.
huntress.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.