You’re searching “Claude mac download” on Google. The first sponsored result points to claude.ai, so the URL is legitimate. Except it’s a shared Claude chat where a fake “Apple Support” dictates a Terminal command to paste. You paste it, and MacSync steals your Keychain, cookies, and browser credentials.

The Fact

Berk Albayrak (Trendyol Group) and BleepingComputer have been documenting since May 10, 2026, an active macOS malvertising campaign that exploits two legitimate mechanisms simultaneously. First, Google Ads: a sponsored ad for “Claude mac download” points to claude.ai, Anthropic’s official domain. Then, Claude.ai Share: this feature is used to host a fake installation guide signed “Apple Support” that tells the user to paste a base64-encoded command into Terminal.

The command downloads a polymorphic shell script from the attacker’s infrastructure, checks the keyboard layout (exits immediately if Russian or CIS), then executes the second-stage payload via osascript (macOS’s native AppleScript engine) for fileless delivery. The malware is called MacSync, an infostealer that collects browser credentials and cookies, exfiltrates the macOS Keychain, and fingerprints the victim (IP, hostname, OS version, keyboard language).

The indicators of compromise published are payload customroofingcontractors[.]com/curl/ and bernasibutuwqu2[.]com/debug/loader.sh, exfiltration to briskinternet[.]com. The two identified Claude.ai Share URLs are claude[.]ai/share/9aac1046-a39e-4618-8265-f54c4be863f7 and claude[.]ai/share/eb2db455-1d47-4baf-8671-0a689e165902.

Don’t worry, the links are disabled here, but Anthropic hadn’t disabled the Share mechanism at the time of BleepingComputer’s publication.

Why This is a Game-Changer

Two things, really. First, the “shared chat” feature of a public AI platform becomes a malware distribution surface. Claude.ai’s shared pages are public, indexable, and notably, not moderated like typical user content. They inherit Anthropic’s visual trust, and at the time of BleepingComputer and GBHackers’ publications, both compromised share URLs were still online.

Second, AI brand hijacking joins known malvertising schemes (Homebrew, Loom, Notion, AnyDesk), with Claude Code being a recent dev tool, its official installation page isn’t yet a muscle memory reflex, leaving an exploitable window.

This is also a case study on Google Ads, despite announced controls, ads impersonating brands continue to slip through, exploiting the legitimate display URL while pointing to a compromised page on the editor’s own site.

Domain validation isn’t enough when the editor hosts user content. Responsibility is shared, Anthropic needs to beef up shared chat moderation (detect chats posing as official support of other brands, banner on chats containing shell commands, visual watermark distinguishing a shared chat from a product page), Google needs to go beyond display domain in Ads validation. But the last line is you, never paste a Terminal command blindly.

Why This Matters to You

The social engineering pattern here is ruthless because it chains two usually legitimate trust signals. The claude.ai official domain, native Anthropic Share feature, fake “Apple Support” in a supposedly serious AI environment. You’re not clicking on some obscure download site, you’re clicking on what looks like official documentation brought up by a search engine, exactly the kind of attack that slips under usual vigilance.

The target is wide. Not just developers (Homebrew, GitHub), but any Mac user curious to try Claude desktop. The malware doesn’t require any system elevation, no 0day, no TCC bypass, the user does all the work themselves by pasting the command. And since osascript is a native, signed Apple binary, it slips under most commercial EDRs and even XProtect.

The angle that concerns you directly: it’s the offensive return of the macOS Keychain as a prime target. You’ve learned to protect your Mac’s user password, enable FileVault, use Touch ID. But a Terminal command launched by yourself circumvents all that, because you’re the one opening the door.

What You Do Now

1. Never paste a Terminal command dictated by a website, AI chat, or “official support” PDF. If you must install a tool like Claude desktop, go directly to claude.ai/download by typing the URL yourself, never via a sponsored Google result. The universal rule: if someone tells you to paste anything into Terminal, it’s a no.

2. Enable Little Snitch or LuLu in hardened silent mode. Both log and block unexpected outgoing network connections to the published IOCs (customroofingcontractors[.]com, bernasibutuwqu2[.]com, briskinternet[.]com). If you suspect a hasty command, check outgoing connections in the minutes after.

3. If you’ve run a suspicious command recently: disconnect from Wi-Fi immediately, change all your browser passwords (from a clean device), revoke all active cloud session tokens (mail, sync, password manager), scan with KnockKnock or ReiKey from Objective-See, check launch agents in ~/Library/LaunchAgents/.

4. Monitor your Keychain. security dump-keychain | grep -i password tells you what’s inside. For the future, migrate sensitive passwords to Apple Passwords or Proton Pass, not the general iCloud Keychain by default.

Sources

• https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-claudeai-chats-to-push-mac-malware/
• https://objective-see.org/products/knockknock.html

See Also

• The ClickFix script editor (the paste-and-pwn pattern)
• SparkCat on the App Store (when Apple lets something through)
• Little Snitch vs LuLu (outgoing firewall for Mac)