Fake Claude Code Install Guide Uses Google Ads to Deliver MacSync Infostealer

Fake Google Ads are being used to push a convincing Claude Code installation guide that delivers the MacSync infostealer to macOS users. The campaign turns an ordinary developer search into a path for credential theft and wider account compromise.

The attack starts when a user searches for Claude Code installation help and clicks a sponsored result.

The ad appears to lead to Claude’s real website, giving victims little reason to question the guide before copying its terminal command.

Analysts from Deriv AI identified that the command conceals its real download location with Base64 encoding.

That hidden destination downloads MacSync, which targets passwords, browser sessions, developer credentials, and cryptocurrency wallet data.

Deriv AI said in a report shared with Cyber Security News (CSN) that the campaign is especially concerning because it does not require a browser flaw, a phishing email, or a hacked vendor website.

Instead, it abuses trusted pages, familiar brand signals, and the common habit of following the first search result.

Fake Claude Code Install Guide

The sponsored ad used a Claude-themed headline and displayed the legitimate claude.ai domain.

After the click, victims reached a real Claude share page that was presented as an installation guide and labeled as shared by Apple Support, creating several misleading signs of trust.

The guide’s command did not visibly show the server that would receive the request.

It used Base64 text and shell command substitution to decode the destination only when the command ran, a tactic similar to techniques seen in encoded Base64 malware commands that hide harmful activity from a quick review.

Once decoded, the command contacted infrastructure unrelated to the software vendor and used curl’s -k option, which skips certificate validation.

The researchers found that the same infrastructure supported payload delivery, command-and-control activity, and wallet-focused data theft.

The operation also cycled multiple Claude share-page lures under the same Google Ads campaign.

This approach means that removing one malicious guide or advertisement may not stop the wider campaign, much like other Google Ads installer attacks that exploit users searching for trusted software.

Credential Theft and Recovery

MacSync can collect macOS Keychain information, stored browser passwords, session cookies, SSH keys, cloud credentials, Kubernetes settings, and developer tokens.

Stolen session cookies can allow attackers to take over logged-in accounts without requiring the victim’s usual multi-factor authentication step.

For developers, the consequences can extend beyond a single Mac. Access to source repositories, cloud environments, package publishing accounts, and deployment systems may be exposed, reflecting why macOS infostealer campaigns expand into developer-focused workflows.

The malware also targets Telegram Desktop sessions and more than 80 cryptocurrency wallets. Researchers warned that it can modify Ledger Live to capture wallet information, so simply deleting the infostealer may leave a compromised wallet application behind.

MacSync establishes persistence through a LaunchAgent that resembles a Google Keystone updater and leaves staging files on the system.

Security teams should treat any execution of the command as a full device and credential compromise, rather than assuming an antivirus cleanup alone resolves the incident.

Users should avoid sponsored results when installing developer tools and instead open the vendor’s official documentation directly.

Before running a terminal command, they should decode hidden text, inspect every destination, and reject commands that disable certificate checks or connect to unrelated domains.

If the command was executed, the affected Mac should be isolated immediately and no longer used for recovery actions.

From a clean device, victims should rotate passwords and keys, revoke browser and developer sessions, review source-code and CI/CD activity, move cryptocurrency to a new wallet, and reimage the Mac.

These steps are increasingly important as macOS malware uses Google Ads to exploit trust in search results and recognizable online services.

Reporting the malicious share page and the associated ad campaign can also help disrupt related lures.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.