Shared Claude Chats Meet ClickFix

This threat involves a ClickFix campaign exploiting Anthropic's Claude platform's shareable chat feature to distribute MacSync Stealer malware. Attackers used malvertising with paid Google ads targeting users searching for Claude-related content, redirecting them to malicious shared chats falsely labeled as 'Apple Support.' These chats contained obfuscated commands that, when executed, initiated a multi-stage infection chain on macOS systems. The malware exfiltrates credentials from browsers and password managers, cryptocurrency wallet information, sensitive files, and system details. The campaign was active for one week in June 2026 and included Russian-language comments in the code, indicating likely Russian-speaking threat actors. The attackers used domains themed around U.S. local services to enhance legitimacy. There is no indication of known exploits in the wild beyond this campaign, and no patch or official fix is applicable as this is a social engineering and malware distribution campaign rather than a software vulnerability.

The campaign results in credential theft from browsers and password managers, theft of cryptocurrency wallet data, exfiltration of sensitive files, and collection of system information on infected macOS devices. This can lead to account compromise, financial loss, and privacy breaches for affected users. The infection chain is multi-stage and relies on user execution of obfuscated commands delivered via malicious shared chat links. The campaign specifically targets macOS users and leverages social engineering through malvertising and impersonation of Apple Support.

No official patch or fix is applicable as this is a malware distribution campaign abusing a legitimate platform's share feature. Mitigation focuses on user awareness to avoid executing commands from untrusted shared chat links, especially those received via search results or ads. Organizations and users should be cautious of malvertising campaigns and verify the authenticity of support channels. Since this campaign exploits social engineering rather than a software vulnerability, standard endpoint protection and user training are recommended. Monitor for suspicious activity related to credential theft and malware infection on macOS devices.