MacSync Stealer distributed via shared Claude chats in ClickFix campaign

Zscaler Threat Hunting has uncovered a ClickFix campaign that abuses Anthropic’s Claude platform to distribute MacSync Stealer. The attackers used paid search ads to lure Mac users searching for ‘claude download’ to shared Claude chats, which hosted instructions to run a malicious curl command.

The command, obfuscated with Base64, downloaded a zsh script that eventually delivered the stealer. MacSync Stealer collects credentials, browser data, cryptocurrency wallets, and files from the victim’s system, and exfiltrates them in chunks. The campaign ran from June 12 to 19, 2026, and used domains themed around local US services.

Zscaler notified Anthropic, and the shared chats were taken down before publication.