Fake Claude Search Results Lead macOS Users to MacSync Stealer

Summary

Threat actors are abusing malvertising in Google search results to redirect users to legitimate Claude.ai shared conversations containing instructions to execute malicious curl commands. The attack chain delivers MacSync, an advanced macOS stealer and RAT designed to exfiltrate credentials, Keychain secrets, and cryptocurrency wallet data. The malware follows a complex six-stage kill chain involving in-memory execution and abuse of TCC permissions.

Investigation

Huntress analysts investigated the malvertising campaign after a customer was compromised through a fraudulent Claude installation guide. Researchers bypassed attacker protections and retrieved a malware sample directly from the adversary’s infrastructure. The investigation uncovered a multi-stage execution chain involving a zsh loader, AppleScript-based data theft, and a Mach-O RAT used to establish persistence.

Mitigation

Users should avoid copying and executing unverified commands in Terminal, even when instructions appear on legitimate or trusted domains. Security teams should monitor for suspicious curl activity and Base64-encoded content within shell processes. Tools such as BlockBlock and LuLu can also help detect macOS persistence mechanisms and unauthorized outbound network connections.

Response

If MacSync activity is detected, the affected macOS device should be isolated immediately to stop further data exfiltration. Investigators should review shell history and endpoint telemetry for unauthorized curl or zsh execution. TCC permission changes should also be examined, along with unauthorized LaunchAgents and modified application binaries, particularly those associated with cryptocurrency wallets.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary targets the user via a fake software update (malvertising). Once the user executes the provided command in the terminal, curl fetches a malicious script. This script is immediately piped into zsh. The script contains a specific string daemon_function which is used to hide malicious background processes. The detection rule is specifically looking for the combination of curl, zsh, and the daemon_function string in the command line to identify this specific campaign.

• Regression Test Script:

  #!/bin/bash
  # Simulation script for MacSync Malvertising detection validation.
  # This simulates a user running a one-liner that fetches and executes a script.
  
  echo "[+] Starting MacSync Simulation..."
  
  # We simulate the command by creating a local "malicious" script 
  # and then executing the exact command line pattern the rule looks for.
  
  echo "function daemon_function() { echo 'Exfiltrating data...'; }; daemon_function" > /tmp/fake_payload.sh
  chmod +x /tmp/fake_payload.sh
  
  # This is the exact pattern: curl + zsh + daemon_function
  # We use a subshell to simulate the piping behavior
  echo "[+] Executing malicious command line..."
  curl -s http://localhost/fake_payload.sh | zsh -s daemon_function
  
  echo "[+] Simulation command executed."

• Cleanup Commands:

  # Remove the simulated payload and temporary files.
  rm /tmp/fake_payload.sh
  echo "[+] Cleanup complete."