Your email could be compromised.
Scan it on the dark web for free – no signup required.
For years, the standard advice for avoiding malware has been simple: check the URL. If it’s the real domain, you’re probably safe.
That advice just stopped working.
What’s Happening?
Security researchers at Huntress recently reverse-engineered a new macOS malware family called MacSync, and the way it spreads breaks the usual rules. The infection doesn’t start on a shady lookalike site. It starts with a Google search for something as mundane as “how to install Claude on a Mac,” a sponsored ad placed above the real result, and a landing page hosted on the actual claude.ai domain.
That page is a real, publicly shared AI conversation — dressed up to look like an official Apple Support installation guide. It walks the visitor through pasting a single command into Terminal. The command is Base64-obfuscated, so anyone glancing at it before running it sees gibberish, not a red flag. Once executed, it quietly pulls in a six-stage stealer and remote access trojan built to harvest browser passwords, macOS Keychain data, session cookies, SSH keys, cloud tokens, and cryptocurrency wallets.
Nothing about Anthropic’s systems was compromised. No software vulnerability was exploited. The attackers simply used a real platform’s own “share” feature as free, trustworthy-looking hosting for their instructions — and paid to have it placed above the legitimate result.
This Isn’t a One-Off
What makes this worth paying attention to isn’t the individual campaign — it’s the pattern. This is the third documented case this year of attackers distributing malware through poisoned search ads that point to AI-hosted “install guides.” Earlier campaigns used the same trick with shared ChatGPT and Grok conversations to spread different stealer families. Different AI platforms, different malware, identical playbook.
That’s a meaningful shift. Traditional phishing relies on convincing you a fake thing is real. This technique doesn’t need to: the domain, the hosting, the “shared by” branding are all genuinely real. The only fake part is the instructions sitting on top of them — and that’s the part everyone’s been trained to trust.
Why the Old Advice Doesn’t Cover This
Most security guidance boils down to a handful of checks: look at the domain, look for HTTPS, look for spelling errors. Those checks still matter, but they were built for an era when attackers had to fake the infrastructure. Here, the infrastructure isn’t faked — it’s borrowed.
A few things this campaign quietly exploits:
- Sponsored placement above organic results. Most people click the first thing that looks relevant, which is exactly where a paid ad sits.
- Terminal commands as a normalized install step. Developers and technical users are used to copy-pasting setup commands without reading every character, especially when the source looks legitimate.
- Obfuscation hiding in plain sight. A Base64-encoded command looks like noise, not danger, to anyone without a reason to decode it first.
- Reused infrastructure across lures. Researchers noted the campaign cycled through multiple share-page lures under the same ad campaign, meaning taking down one malicious page doesn’t stop the operation.
What Actually Helps?
None of this means AI install guides are inherently unsafe, or that Terminal commands should be avoided outright. It means the verification step has to move further down the chain.
A VPN cannot prevent you from manually running a malicious command, so it should not be treated as a replacement for antivirus software, careful verification, or secure password practices.
- Go to the source, not the search result. For any tool’s installation instructions, navigate to the vendor’s own documentation directly rather than clicking a sponsored link, even one that appears to point to the right domain.
- Read before you paste. If a command is obfuscated or encoded, decode it first or skip it. Legitimate installation instructions rarely need to hide what they’re doing.
- Treat “official-looking” as necessary, not sufficient. A real domain, correct branding, and professional formatting are now table stakes for attackers, not proof of safety.
- Watch for the sponsored tag. It sounds obvious, but a one-second glance at whether a result is an ad has never mattered more.
- Assume credential theft, not just malware, is the goal. If you’ve ever run an unfamiliar install command, rotating stored passwords and revoking active sessions costs a few minutes and closes the door on months of exposure.
The Bigger Picture
Attackers have realized that the fastest way past a skeptical user isn’t building better fakes — it’s borrowing real trust. As AI tools become a normal part of everyday workflows, expect more of this: not attacks on the platforms themselves, but attacks that rent space on them. The websites are real. The brands are real. The only thing to verify now is what’s actually being asked of you once you get there.
