ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Huntresspublished ()ingested

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer

mediumMalware exploited in the wildimportance 55
AI summary · glm-5.3-flash

Huntress dissects MacSync Stealer, a macOS infostealer delivered through fake Claude Code download pages in Google search results.

Huntress SOC analysts published a reverse-engineering analysis of MacSync Stealer, a macOS infostealer distributed through fraudulent Claude Code download pages surfaced via web searches. Users searching for Anthropic's Claude coding tool are redirected to fake download pages that install the stealer, abusing developer trust in popular AI tooling. The writeup covers the analysis of the sample and its delivery chain.

  • Delivered via fake Claude Code download pages found through web searches
  • macOS infostealer dissected by Huntress SOC reverse engineering
  • Attackers abuse developer trust in popular AI coding tools
Read the original
VendorsHuntress
ProductsClaude Code
MalwareMacSync Stealer
OrganizationsHuntressAnthropic
AI modelsClaude
Tagsmacsyncinfostealermacosclaudeseo-poisoningfake-downloadshuntress
Full article

Huntress SOC analysts reverse engineer MacSync Stealer, a macOS infostealer spread through fake Claude Code download pages. Watch the full analysis.

This source does not provide full text. Read it at huntress.com.