A highly convincing malvertising campaign is targeting macOS users searching for “how to install Claude Code on Mac,” delivering the MacSync infostealer through a trusted-looking workflow that abuses legitimate infrastructure rather than exploiting software vulnerabilities.
The attack highlights a growing shift toward trust-based compromise, where attackers weaponize authentic platforms such as Google Ads and claude.ai to bypass traditional user scrutiny.
The ad links to a genuine claude.ai domain, reinforcing legitimacy through correct branding and placement alongside Anthropic’s official installation documentation.
However, the malicious ad redirects users to a claude.ai/share page that mimics an installation guide attributed to “Apple Support,” creating a layered trust illusion using both a real domain and a recognizable brand.
Unlike traditional phishing, the landing page is not a spoof. It is a legitimate Claude share link containing attacker-controlled content.
Embedded within the guide is a modified installation command that leverages Base64 encoding and shell command substitution to obscure its true behavior.
The command structure silently decodes a hidden string before executing curl, preventing users from seeing the actual download endpoint during casual inspection.
The use of the “-k” flag in curl disables TLS certificate validation, further indicating malicious intent. This technique allows the command to appear benign while masking critical indicators until execution.
Infrastructure analysis shows hybridcustomhomes[.]com operating as part of a broader command-and-control ecosystem.
Endpoints such as /dynamic?txd= function as beaconing channels, while /gate provides secondary C2 communication. Additional paths linked to Ledger Live trojanization suggest cryptocurrency-focused targeting.
SubStack Researchers said that, the campaign begins with a sponsored Google ad labeled “Claude Code Mac,” prominently displayed above organic results.
The domain itself is an aged asset repurposed for malicious use, a tactic increasingly favored for evading reputation-based detection.
Similar domains, including houstongaragedoorinstallers[.]com and mansfieldpediatrics[.]com, follow the same naming convention and infrastructure patterns, indicating a scalable deployment model.
Multiple claude.ai/share URLs tied to the same Google Ads campaign ID suggest redundancy designed to maintain persistence even if individual lures are removed.
Fake Claude Code Installer
Correlation with CrowdStrike Intelligence confirms the activity aligns with known MacSync campaigns, including matching payload hashes and Cloudflare-fronted IP addresses 104.21.40[.]24 and 172.67.174[.]150.
MacSync itself is a high-impact macOS infostealer focused on credential and session theft. It targets macOS Keychain data, browser cookies, SSH keys, cloud credentials, Kubernetes configurations, and developer tokens.
It also extracts Telegram session data and supports exfiltration from over 80 cryptocurrency wallets.
Notably, it can trojanize Ledger Live applications, enabling long-term compromise even after initial infection is removed.
Persistence is achieved via a LaunchAgent masquerading as a Google Keystone updater located at ~/Library/LaunchAgents/com.google.keystone.agent.plist, with staging artifacts observed in temporary directories.
The effectiveness of this campaign lies in its ability to satisfy standard security checks. The domain is legitimate, the interface is authentic, and the workflow mirrors normal developer behavior.
Even manual command inspection fails because the critical destination is encoded.
This demonstrates that domain validation alone is no longer sufficient, particularly when attackers leverage trusted platforms as delivery vectors.
This incident underscores the need for deeper verification practices, including decoding obfuscated commands and validating all outbound connections before execution.
As attackers continue to refine social-engineering techniques within legitimate ecosystems, security awareness must evolve beyond surface-level indicators to include behavioral and contextual analysis.
What Features Should AI SOC Have in 2026? A Complete Checklist : Download the AI SOC Features Checklist
