Google Ads and Claude Shares Spread Mac Stealer and Windows RAT

Gen Digital researchers have uncovered a Claude malware campaign that exploits Claude’s own sharing features and Google Ads to distribute malicious payloads to macOS and Windows users. The operators did not compromise Anthropic’s infrastructure or register a counterfeit Claude domain; instead they created fake download pages within Claude[.]ai using public Shared Chats and Artifacts, then purchased Google Ads to drive traffic.

A lure under the alias “John Gol” promoted a fake “Claude Code on Mac” guide, with the site presenting a valid HTTPS certificate on Anthropic’s real domain to appear trustworthy.

Infection chains differ by platform. On macOS, users are prompted to open Terminal, paste an encoded command via a ClickFix-style trick, and upon execution the loader downloads a second script that installs an AppleScript build of Atomic macOS Stealer. If Full Disk Access is not granted, a fake alert is shown, a shell startup entry is created for persistence, and a fake System Preferences password dialog is displayed to obtain the macOS login password.

Windows victims are redirected through Run dialog commands into a malicious PowerShell script that fakes a verification progress bar before contacting a GitHub Pages domain to fetch an encrypted .NET remote access trojan, which then injects into a legitimate process. The campaign’s data-exfiltration behaviour includes stealing Keychain data, browser cookies and logins, and scanning for wallet-related files, then exfiltrating them as a ZIP archive.

A macOS variant searches for Ledger Live and Trezor Suite, potentially replacing them with trojanised versions to harvest seed phrases. Windows payloads provide persistent command-server connectivity, and monitor antivirus presence, window titles, and wallet applications.