Cybercriminals conducted a sophisticated malvertising operation from April to June 2026, leveraging Google Ads to impersonate AI developer tools such as Claude AI and ChatGPT Codex. They deployed 106 unique malicious hostnames in six waves, initially hosting social engineering ClickFix pages on GitLab infrastructure before exploiting the legitimate shared chat feature of claude.ai to deliver malicious commands. The campaign targeted technically proficient users searching for AI development tools, tricking them into executing terminal commands that installed the MacSync infostealer. This malware harvested sensitive credentials including browser data, SSH keys, and cryptocurrency wallets. The Asia-Pacific region bore the brunt of the attacks, with 67.2% of over 2,000 victims located there, particularly in Taiwan. Anthropic mitigated the threat by banning malicious accounts and implementing additional abuse protections.

The campaign resulted in credential theft including browser data, SSH keys, and cryptocurrency wallets from over 2,000 victims, primarily in the Asia-Pacific region. The use of legitimate claude.ai shared chat for malicious command delivery represents abuse of a trusted platform feature. The stolen credentials could lead to further compromise of victim systems and accounts.

Anthropic has banned malicious accounts involved in the campaign and implemented additional abuse mitigations on the claude.ai platform. Users should avoid executing untrusted terminal commands, especially those received via chat or impersonated AI tools. Monitor for suspicious domains and URLs associated with this campaign. Patch status is not applicable as this is an abuse of platform features rather than a software vulnerability. Check vendor advisories for updates on abuse prevention.