Threat Actors Exploit Claude Artifacts and Google Ads to Target macOS Users
A recent malware campaign has been discovered targeting macOS users through Google-sponsored search results. This campaign exploits trusted platforms such as Anthropic's Claude AI and Medium, reaching over 15,000 potential victims through two distinct…
A recent malware campaign has been discovered targeting macOS users through Google-sponsored search results. This campaign exploits trusted platforms such as Anthropic's Claude AI and Medium, reaching over 15,000 potential victims through two distinct attack variants.
The first attack vector employs Google Ads to distribute a malicious Claude AI artifact disguised as a legitimate macOS security guide. Users searching for "Online dns resolver" may encounter a sponsored link leading to a deceptive document titled "macOS Secure Command Execution." This document instructs users to execute a base64-encoded command in their Terminal application, which decodes and runs a malicious shell script. This script downloads the MacSync information stealer malware .
The malware establishes communication with its command-and-control server at a2abotnet[.]com/dynamic using a hardcoded authentication token and API key. To evade detection, it disguises its network traffic as normal web browsing activity by spoofing legitimate macOS browser User-Agent strings. The payload also includes an AppleScript component for data theft, targeting sensitive information such as keychain credentials, browser data, and cryptocurrency wallet files.
The second attack variant targets users searching for "macos cli disk space analyzer" via a Medium article on apple-mac-disk-space.medium[.]com. This article impersonates Apple’s Support Team and uses similar social engineering techniques, employing double-layered encoding and different hosting infrastructure.
The malicious command utilizes string concatenation techniques, such as "cur””l" instead of "curl", to bypass detection systems and YARA rules. Both attack variants illustrate the growing trend of threat actors abusing legitimate platforms and trusted services to disseminate malware.
A recent malware campaign has been discovered targeting macOS users through Google-sponsored search results.
Verify the authenticity of sources in sponsored search results. Avoid executing terminal commands from unfamiliar sources, especially if they claim to be from Apple or other trusted vendors. Implement endpoint detection solutions to monitor suspicious terminal activity and network connections to unknown servers.
Indicator Type Indicator Description
Domain a2abotnet[.]com Command and control server
Domain raxelpak[.]com Payload hosting domain
Domain apple-mac-disk-space.medium[.]com Fake Apple support article
File Path /tmp/osalogging.zip Staging file for stolen data
Malware MacSync Information stealer targeting macOS
Based on reporting by Cyber Security News.