Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware
Attackers distribute MacSync macOS infostealer via fake Claude and ChatGPT installers and sponsored search ads, stealing passwords, cookies, keys, and wallets.
SEQRITE reports a malware-as-a-service campaign pushing MacSync, a macOS password stealer, through sponsored search results and fake Claude and ChatGPT download pages. ClickFix-style prompts trick users into pasting a Terminal command that launches a stager, which loads an in-memory AppleScript to harvest credentials. The malware collects browser vaults, Keychain data, SSH keys, session cookies, messaging sessions, and cryptocurrency wallets, then persists via renamed LaunchAgents and can request screen-recording permissions.
- MacSync runs as malware-as-a-service, supplying tooling and infrastructure to other criminal groups.
- ClickFix prompts trick users into pasting commands into Terminal, launching the infection.
- Stealer harvests browser vaults, Keychain data, SSH keys, session cookies, and crypto wallets.
- Malware persists via renamed LaunchAgents and requests screen-recording permission for surveillance.
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | asia.newsinweb.com | drivinguber.com Primary command-and-control host C2 domain asia.newsinweb.com Regional fallback command-and-control host C2 domain usa.ne |
| domain | drivinguber.com | ist Possible renamed LaunchAgent persistence file C2 domain drivinguber.com Primary command-and-control host C2 domain asia.newsinweb.c |
| domain | newsinweb.com | m Regional fallback command-and-control host C2 root domain newsinweb.com Root domain used for fallback infrastructure Download URI / |
| domain | usa.newsinweb.com | eb.com Regional fallback command-and-control host C2 domain usa.newsinweb.com Regional fallback command-and-control host C2 root domain n |
| md5 | 9678f71ea4cccbc3d511dc8d7f24b113 | 25f44db68a MacSync sample hash reported by SEQRITE MD5 hash 9678f71ea4cccbc3d511dc8d7f24b113 MacSync sample MD5 hash SHA-1 hash 59508d071661ea70fa5fcbe6 |
| md5 | de62a2f47d1c7dec2997f931a050a615 | h used for stolen-data uploads HTTP request header api-key: de62a2f47d1c7dec2997f931a050a615 API key observed in MacSync network requests HTTP User-Agen |
| sha1 | 59508d071661ea70fa5fcbe6f9e2fb72506e57df | a4cccbc3d511dc8d7f24b113 MacSync sample MD5 hash SHA-1 hash 59508d071661ea70fa5fcbe6f9e2fb72506e57df MacSync sample SHA-1 hash Code-signing identifier com.utils |
| sha1 | d182eb7cba0ffa42d770d7b0d3499e49f24163a2 | ils.Launcher Ad-hoc-signed MacSync stager identifier CDHash d182eb7cba0ffa42d770d7b0d3499e49f24163a2 Code directory hash associated with the sample Staged archi |
From the original article
4 min read at cybersecuritynews.com
Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer. The campaign relies on persuasion instead of a software flaw.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.