Shared Claude Chats Meet ClickFix
A ClickFix campaign has been identified that abuses Anthropic's Claude platform through shareable chat links to distribute MacSync Stealer targeting macOS users. Attackers utilized malvertising with paid Google ads to direct victims searching for Claude-related terms to malicious shared Claude chats falsely labeled as 'Apple Support.' These chats contained obfuscated installation commands that, when executed, deployed a multi-stage infection chain. The malware steals credentials from browsers and password managers, cryptocurrency wallet data, sensitive files, and system information. The campaign ran from June 12-19, 2026, targeting primarily Mac users with Russian-language comments in the code suggesting Russian-speaking threat actors. Domains used adopted themes related to U.S. local services to appear legitimate.
AI Analysis
Technical Summary
This threat involves a ClickFix campaign exploiting Anthropic's Claude platform's shareable chat feature to distribute MacSync Stealer malware. Attackers used malvertising with paid Google ads targeting users searching for Claude-related content, redirecting them to malicious shared chats falsely labeled as 'Apple Support.' These chats contained obfuscated commands that, when executed, initiated a multi-stage infection chain on macOS systems. The malware exfiltrates credentials from browsers and password managers, cryptocurrency wallet information, sensitive files, and system details. The campaign was active for one week in June 2026 and included Russian-language comments in the code, indicating likely Russian-speaking threat actors. The attackers used domains themed around U.S. local services to enhance legitimacy. There is no indication of known exploits in the wild beyond this campaign, and no patch or official fix is applicable as this is a social engineering and malware distribution campaign rather than a software vulnerability.
Potential Impact
The campaign results in credential theft from browsers and password managers, theft of cryptocurrency wallet data, exfiltration of sensitive files, and collection of system information on infected macOS devices. This can lead to account compromise, financial loss, and privacy breaches for affected users. The infection chain is multi-stage and relies on user execution of obfuscated commands delivered via malicious shared chat links. The campaign specifically targets macOS users and leverages social engineering through malvertising and impersonation of Apple Support.
Mitigation Recommendations
No official patch or fix is applicable as this is a malware distribution campaign abusing a legitimate platform's share feature. Mitigation focuses on user awareness to avoid executing commands from untrusted shared chat links, especially those received via search results or ads. Organizations and users should be cautious of malvertising campaigns and verify the authenticity of support channels. Since this campaign exploits social engineering rather than a software vulnerability, standard endpoint protection and user training are recommended. Monitor for suspicious activity related to credential theft and malware infection on macOS devices.
Indicators of Compromise
- domain: buywx.com
- domain: cincycarpetcleaning.com
- domain: homeinspectionsdelaware.com
- domain: vacationrentalvirginia.com
- domain: sonyda.com
- domain: trailblazehealth.com
- domain: sdlasik.com
- domain: pine-1.com
- domain: toledotreeservices.com
- domain: olympiapetemergency.com
- domain: newjerseypetsitter.com
- domain: charlottefilmstudios.com
- domain: seattlefilmstudios.com
- domain: alluringsites.com
- domain: jerryshvac.com
- domain: customroofingcontractors.com
- domain: kidsjumpandplay.com
- domain: floridakitchencabinet.com
- domain: journey71.com
- domain: realtorsmichigan.com
- domain: fullcolorprinters.com
- domain: nationalspacecouncil.com
- domain: miamidadenotary.com
- domain: lalandscapelighting.com
- domain: aisolutions247.com
- domain: healthcareqai.com
- domain: briskinternet.com
- domain: belldredgingpump.com
- domain: kylesplumbing.com
- domain: modernhomeai.com
- domain: coeragent.com
- domain: beachjiujitsu.com
- domain: bcrealestateagency.com
- domain: fractocode.com
- domain: houstonpestcontrolcompany.com
- domain: whichitaautosales.com
- domain: 3plfast.com
- domain: aidevmaster.com
- domain: dallasoverheaddoors.com
- domain: dualverify.com
- domain: trufflecatering.com
- domain: ednasoftware.com
- domain: elitefenceanddeck.com
- domain: cashlessend.com
- domain: spotlessridesdetailing.com
- domain: drivinguber.com
- domain: curretagent.com
- domain: kitchenbathremodels.com
- domain: ncsolarpanel.com
- domain: api-metrics-5453.com
- domain: touristprogram.com
- domain: napavalleymentalhealth.com
- domain: bestbuydomain.com
- domain: iowagaragedoor.com
- domain: unifiedaiapi.com
- domain: byrnewealthmanagement.com
- domain: homeinspectionnaperville.com
- domain: orbitstride7.com
- domain: web-stat-2685.com
- domain: yoauction.com
- domain: chicagometalscrap.com
- domain: paeviction.com
- domain: affordabletentrentals.com
- domain: alabamarecoverycenter.com
- domain: cedar-satin.com
- domain: rudderwillow8.com
- domain: pinescope11.com
- domain: coloradoconstructionsupply.com
- domain: marbellaresales.com
- domain: 5x5web.com
- domain: driftpress11.com
- domain: blueprintmesh.com
- domain: aigenerativeos.com
- domain: sreachagent.com
- domain: dallasirrigationservices.com
- domain: delta-66.com
- domain: dramshopliabilityattorney.com
- domain: anvil-89.com
- domain: aspen32.com
- domain: renderframe20.com
- domain: lifecoachrochester.com
- domain: buynewgymequipment.com
- domain: maplecirrus.com
- domain: lyricopal1.com
- domain: harvest-53.com
- domain: lasvegaslaminateflooring.com
- domain: pdrncosmetics.com
- domain: robscarpetcleaning.com
- domain: dogtrainersgeorgia.com
- domain: tide-39.com
- domain: syracusefertilitycenter.com
- domain: centralfloridapowerwash.com
- domain: majordubai.com
- domain: luxuryswisshomes.com
- domain: coloradoaffordablelawyer.com
- domain: garagedoorskentucky.com
- domain: slate16.com
- domain: denverplumbingandwaterheater.com
- domain: proviewhomeinspections.com
- domain: genomicsforge.com
- domain: chant-78.com
- hash: 0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- url: http://lasvegaslaminateflooring.com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- url: http://lasvegaslaminateflooring.com/dynamic?txd=0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- url: http://lasvegaslaminateflooring.com/ledger/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- url: http://lasvegaslaminateflooring.com/ledger/live/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- url: http://lasvegaslaminateflooring.com/trezor/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
- domain: 589669.cc
- domain: 625167.cc
- domain: 699524.cc
- domain: advertisingeffectively.com
- domain: agingfighter.com
- domain: aleeci.com
- domain: amedatur.com
- domain: anvil-wave.com
- domain: anvillyric1.com
- domain: apxeagent.com
- domain: arbokfind.com
- domain: atlanticwoodworking.com
- domain: ballad82.com
- domain: balladspark.com
- domain: bitcoinlnwallet.com
- domain: cabinrentalsnc.com
- domain: canvas-coral.com
- domain: chisel-perch.com
- domain: codxeagent.com
- domain: conenctagent.com
- domain: dubaivehiclemart.com
- domain: emberjourney18.com
- domain: empexf.com
- domain: envestassetmanagement.com
- domain: fablecube15.com
- domain: fern-76.com
- domain: fern16.com
- domain: flintfeather5.com
- domain: floridavacationvillarental.com
- domain: forgeboost16.com
- domain: forgequest2.com
- domain: fredscarpetcleaning.com
- domain: gainesvillewebsitedesign.com
- domain: garden13.com
- domain: gatravelagency.com
- domain: georgia.com
- domain: glowworkshop15.com
- domain: greenactiv.com
- domain: harbor-29.com
- domain: havenaspen2.com
- domain: hawaiiwindowtinting.com
- domain: ideanica.com
- domain: jozuvisuals.com
- domain: kernel-frame.com
- domain: kernelfable.com
- domain: kirkcharlie.com
- domain: kitefeather5.com
- domain: kiteshore.com
- domain: lakevine8.com
- domain: languageschoolai.com
- domain: lasvegasweddingreception.com
- domain: leaflyric4.com
- domain: lens-kite.com
- domain: longbeachmartialarts.com
- domain: meadow84.com
- domain: meshfeed4.com
- domain: miamipcsupport.com
- domain: moldinspectiondayton.com
- domain: nimbusstratos12.com
- domain: onyxkite.com
- domain: orbitstitch5.com
- domain: pearl-49.com
- domain: pearlswift16.com
- domain: perch-74.com
- domain: plumechisel.com
- domain: prmieagent.com
- domain: pubre.com
- domain: purtwre.com
- domain: quartzleap5.com
- domain: quest-38.com
- domain: quest-raster.com
- domain: quill-67.com
- domain: quillchisel20.com
- domain: rudder-bloom.com
- domain: rudder93.com
- domain: satin40.com
- domain: satin87.com
- domain: scope-quest.com
- domain: shoresatin.com
- domain: slatesatin.com
- domain: smratagent.com
- domain: stelaragent.com
- domain: stitchstratos.com
- domain: stratos37.com
- domain: stratosnova14.com
- domain: summit-68.com
- domain: summit86.com
- domain: suzke.com
- domain: swisshomesforsale.com
- domain: thevenueapartments.com
- domain: tide-maple.com
- domain: trailshore17.com
- domain: trekmesh15.com
- domain: ursamade.com
- domain: verse-57.com
- domain: vibestride8.com
- domain: vinebridge12.com
- domain: vineworkshop1.com
- domain: willow-blaze.com
- domain: wolfwraps.com
- domain: workshopcurrent.com
- domain: workshoplens.com
- domain: xprssit.com
- domain: znoeagent.com
Shared Claude Chats Meet ClickFix
Description
A ClickFix campaign has been identified that abuses Anthropic's Claude platform through shareable chat links to distribute MacSync Stealer targeting macOS users. Attackers utilized malvertising with paid Google ads to direct victims searching for Claude-related terms to malicious shared Claude chats falsely labeled as 'Apple Support.' These chats contained obfuscated installation commands that, when executed, deployed a multi-stage infection chain. The malware steals credentials from browsers and password managers, cryptocurrency wallet data, sensitive files, and system information. The campaign ran from June 12-19, 2026, targeting primarily Mac users with Russian-language comments in the code suggesting Russian-speaking threat actors. Domains used adopted themes related to U.S. local services to appear legitimate.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This threat involves a ClickFix campaign exploiting Anthropic's Claude platform's shareable chat feature to distribute MacSync Stealer malware. Attackers used malvertising with paid Google ads targeting users searching for Claude-related content, redirecting them to malicious shared chats falsely labeled as 'Apple Support.' These chats contained obfuscated commands that, when executed, initiated a multi-stage infection chain on macOS systems. The malware exfiltrates credentials from browsers and password managers, cryptocurrency wallet information, sensitive files, and system details. The campaign was active for one week in June 2026 and included Russian-language comments in the code, indicating likely Russian-speaking threat actors. The attackers used domains themed around U.S. local services to enhance legitimacy. There is no indication of known exploits in the wild beyond this campaign, and no patch or official fix is applicable as this is a social engineering and malware distribution campaign rather than a software vulnerability.
Potential Impact
The campaign results in credential theft from browsers and password managers, theft of cryptocurrency wallet data, exfiltration of sensitive files, and collection of system information on infected macOS devices. This can lead to account compromise, financial loss, and privacy breaches for affected users. The infection chain is multi-stage and relies on user execution of obfuscated commands delivered via malicious shared chat links. The campaign specifically targets macOS users and leverages social engineering through malvertising and impersonation of Apple Support.
Defensive Guidance
No official patch or fix is applicable as this is a malware distribution campaign abusing a legitimate platform's share feature. Mitigation focuses on user awareness to avoid executing commands from untrusted shared chat links, especially those received via search results or ads. Organizations and users should be cautious of malvertising campaigns and verify the authenticity of support channels. Since this campaign exploits social engineering rather than a software vulnerability, standard endpoint protection and user training are recommended. Monitor for suspicious activity related to credential theft and malware infection on macOS devices.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix"]
- Adversary
- null
- Pulse Id
- 6a57b1d61379f5309f46131d
- Threat Score
- null
Indicators of Compromise
Domain
| Value | Description | Copy |
|---|---|---|
domainbuywx.com | — | |
domaincincycarpetcleaning.com | — | |
domainhomeinspectionsdelaware.com | — | |
domainvacationrentalvirginia.com | — | |
domainsonyda.com | — | |
domaintrailblazehealth.com | — | |
domainsdlasik.com | — | |
domainpine-1.com | — | |
domaintoledotreeservices.com | — | |
domainolympiapetemergency.com | — | |
domainnewjerseypetsitter.com | — | |
domaincharlottefilmstudios.com | — | |
domainseattlefilmstudios.com | — | |
domainalluringsites.com | — | |
domainjerryshvac.com | — | |
domaincustomroofingcontractors.com | — | |
domainkidsjumpandplay.com | — | |
domainfloridakitchencabinet.com | — | |
domainjourney71.com | — | |
domainrealtorsmichigan.com | — | |
domainfullcolorprinters.com | — | |
domainnationalspacecouncil.com | — | |
domainmiamidadenotary.com | — | |
domainlalandscapelighting.com | — | |
domainaisolutions247.com | — | |
domainhealthcareqai.com | — | |
domainbriskinternet.com | — | |
domainbelldredgingpump.com | — | |
domainkylesplumbing.com | — | |
domainmodernhomeai.com | — | |
domaincoeragent.com | — | |
domainbeachjiujitsu.com | — | |
domainbcrealestateagency.com | — | |
domainfractocode.com | — | |
domainhoustonpestcontrolcompany.com | — | |
domainwhichitaautosales.com | — | |
domain3plfast.com | — | |
domainaidevmaster.com | — | |
domaindallasoverheaddoors.com | — | |
domaindualverify.com | — | |
domaintrufflecatering.com | — | |
domainednasoftware.com | — | |
domainelitefenceanddeck.com | — | |
domaincashlessend.com | — | |
domainspotlessridesdetailing.com | — | |
domaindrivinguber.com | — | |
domaincurretagent.com | — | |
domainkitchenbathremodels.com | — | |
domainncsolarpanel.com | — | |
domainapi-metrics-5453.com | — | |
domaintouristprogram.com | — | |
domainnapavalleymentalhealth.com | — | |
domainbestbuydomain.com | — | |
domainiowagaragedoor.com | — | |
domainunifiedaiapi.com | — | |
domainbyrnewealthmanagement.com | — | |
domainhomeinspectionnaperville.com | — | |
domainorbitstride7.com | — | |
domainweb-stat-2685.com | — | |
domainyoauction.com | — | |
domainchicagometalscrap.com | — | |
domainpaeviction.com | — | |
domainaffordabletentrentals.com | — | |
domainalabamarecoverycenter.com | — | |
domaincedar-satin.com | — | |
domainrudderwillow8.com | — | |
domainpinescope11.com | — | |
domaincoloradoconstructionsupply.com | — | |
domainmarbellaresales.com | — | |
domain5x5web.com | — | |
domaindriftpress11.com | — | |
domainblueprintmesh.com | — | |
domainaigenerativeos.com | — | |
domainsreachagent.com | — | |
domaindallasirrigationservices.com | — | |
domaindelta-66.com | — | |
domaindramshopliabilityattorney.com | — | |
domainanvil-89.com | — | |
domainaspen32.com | — | |
domainrenderframe20.com | — | |
domainlifecoachrochester.com | — | |
domainbuynewgymequipment.com | — | |
domainmaplecirrus.com | — | |
domainlyricopal1.com | — | |
domainharvest-53.com | — | |
domainlasvegaslaminateflooring.com | — | |
domainpdrncosmetics.com | — | |
domainrobscarpetcleaning.com | — | |
domaindogtrainersgeorgia.com | — | |
domaintide-39.com | — | |
domainsyracusefertilitycenter.com | — | |
domaincentralfloridapowerwash.com | — | |
domainmajordubai.com | — | |
domainluxuryswisshomes.com | — | |
domaincoloradoaffordablelawyer.com | — | |
domaingaragedoorskentucky.com | — | |
domainslate16.com | — | |
domaindenverplumbingandwaterheater.com | — | |
domainproviewhomeinspections.com | — | |
domaingenomicsforge.com | — | |
domainchant-78.com | — | |
domain589669.cc | — | |
domain625167.cc | — | |
domain699524.cc | — | |
domainadvertisingeffectively.com | — | |
domainagingfighter.com | — | |
domainaleeci.com | — | |
domainamedatur.com | — | |
domainanvil-wave.com | — | |
domainanvillyric1.com | — | |
domainapxeagent.com | — | |
domainarbokfind.com | — | |
domainatlanticwoodworking.com | — | |
domainballad82.com | — | |
domainballadspark.com | — | |
domainbitcoinlnwallet.com | — | |
domaincabinrentalsnc.com | — | |
domaincanvas-coral.com | — | |
domainchisel-perch.com | — | |
domaincodxeagent.com | — | |
domainconenctagent.com | — | |
domaindubaivehiclemart.com | — | |
domainemberjourney18.com | — | |
domainempexf.com | — | |
domainenvestassetmanagement.com | — | |
domainfablecube15.com | — | |
domainfern-76.com | — | |
domainfern16.com | — | |
domainflintfeather5.com | — | |
domainfloridavacationvillarental.com | — | |
domainforgeboost16.com | — | |
domainforgequest2.com | — | |
domainfredscarpetcleaning.com | — | |
domaingainesvillewebsitedesign.com | — | |
domaingarden13.com | — | |
domaingatravelagency.com | — | |
domaingeorgia.com | — | |
domainglowworkshop15.com | — | |
domaingreenactiv.com | — | |
domainharbor-29.com | — | |
domainhavenaspen2.com | — | |
domainhawaiiwindowtinting.com | — | |
domainideanica.com | — | |
domainjozuvisuals.com | — | |
domainkernel-frame.com | — | |
domainkernelfable.com | — | |
domainkirkcharlie.com | — | |
domainkitefeather5.com | — | |
domainkiteshore.com | — | |
domainlakevine8.com | — | |
domainlanguageschoolai.com | — | |
domainlasvegasweddingreception.com | — | |
domainleaflyric4.com | — | |
domainlens-kite.com | — | |
domainlongbeachmartialarts.com | — | |
domainmeadow84.com | — | |
domainmeshfeed4.com | — | |
domainmiamipcsupport.com | — | |
domainmoldinspectiondayton.com | — | |
domainnimbusstratos12.com | — | |
domainonyxkite.com | — | |
domainorbitstitch5.com | — | |
domainpearl-49.com | — | |
domainpearlswift16.com | — | |
domainperch-74.com | — | |
domainplumechisel.com | — | |
domainprmieagent.com | — | |
domainpubre.com | — | |
domainpurtwre.com | — | |
domainquartzleap5.com | — | |
domainquest-38.com | — | |
domainquest-raster.com | — | |
domainquill-67.com | — | |
domainquillchisel20.com | — | |
domainrudder-bloom.com | — | |
domainrudder93.com | — | |
domainsatin40.com | — | |
domainsatin87.com | — | |
domainscope-quest.com | — | |
domainshoresatin.com | — | |
domainslatesatin.com | — | |
domainsmratagent.com | — | |
domainstelaragent.com | — | |
domainstitchstratos.com | — | |
domainstratos37.com | — | |
domainstratosnova14.com | — | |
domainsummit-68.com | — | |
domainsummit86.com | — | |
domainsuzke.com | — | |
domainswisshomesforsale.com | — | |
domainthevenueapartments.com | — | |
domaintide-maple.com | — | |
domaintrailshore17.com | — | |
domaintrekmesh15.com | — | |
domainursamade.com | — | |
domainverse-57.com | — | |
domainvibestride8.com | — | |
domainvinebridge12.com | — | |
domainvineworkshop1.com | — | |
domainwillow-blaze.com | — | |
domainwolfwraps.com | — | |
domainworkshopcurrent.com | — | |
domainworkshoplens.com | — | |
domainxprssit.com | — | |
domainznoeagent.com | — |
Hash
| Value | Description | Copy |
|---|---|---|
hash0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://lasvegaslaminateflooring.com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — | |
urlhttp://lasvegaslaminateflooring.com/dynamic?txd=0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — | |
urlhttp://lasvegaslaminateflooring.com/ledger/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — | |
urlhttp://lasvegaslaminateflooring.com/ledger/live/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — | |
urlhttp://lasvegaslaminateflooring.com/trezor/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb | — |
Threat ID: 6a5803ac68715ace4390f63b
Added to database: 07/15/2026, 22:03:24 UTC
Last enriched: 07/15/2026, 22:17:30 UTC
Last updated: 08/15/2026, 12:11:03 UTC
Views: 231
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.