Hackers Use Fake Claude and ChatGPT Installers to Infect Mac Users With Password-Stealing Malware

Mac users seeking AI tools face a malware trap. Attackers are using fake Claude and ChatGPT installers and sponsored search results to push MacSync, a macOS password stealer.

The campaign relies on persuasion instead of a software flaw. A visitor is told that a download, connection, or verification step has failed, then instructed to copy a command into Terminal. That single action gives the attacker a route into the device.

MacSync is a malware-as-a-service operation, meaning its developers supply the tool and infrastructure to other criminal groups. Researchers said the threat emerged in 2025.

The risk goes beyond a stolen password. MacSync is designed to gather browser logins, session cookies, Mac Keychain data, SSH keys, cloud credentials, messaging sessions, and cryptocurrency wallet information.

SEQRITE said in a report shared with Cyber Security News (CSN) that it can also establish lasting access, leaving personal accounts and workplace systems exposed.

Hackers Use Fake Claude and ChatGPT Installers

The first stage often begins with a search for a desktop AI app. Criminals buy or manipulate search placements and send people to pages that imitate Claude AI, ChatGPT, developer tools, or other trusted services.

A previous report on malicious macOS Google ads shows how paid results can steer high-intent users toward a fraudulent AI download page. Instead of providing a normal application package, the page displays a ClickFix prompt.

These prompts may claim a WebSockets connection needs repair, a CAPTCHA must be completed, or an audio problem requires attention. Victims are asked to paste a helpful-looking command into Terminal, starting the infection themselves.

That technique is effective because it turns the user into the final delivery step. Traditional warning signs, such as an unsolicited attachment, may be absent.

The wider pattern was documented in coverage of macOS ClickFix credential theft, where fake verification pages similarly pushed commands to Mac users. After execution, a shell script launches a background component and unpacks the native MacSync stager.

The stager detaches from the Terminal session, suppresses visible output, and retrieves further instructions from attacker-controlled infrastructure. This layered design lets operators change later payloads.

Stealer Collects Data Quietly

MacSync downloads an AppleScript directly into memory and runs it through a built-in macOS automation utility, rather than saving the script as an obvious file.

The script can display a password request that resembles a system dialog, then collect credentials and other data from the compromised Mac.

The malware packages information, including browser vaults and wallet databases, before sending it to its operators in fixed-size pieces.

If a transfer fails, it retries with increasing delays. After a successful upload, it removes temporary material to reduce evidence for users or incident responders.

It can then deploy a remote-access component that uses the macOS launch mechanism to start after login. A helper program may also request screen-recording permission, giving criminals another opportunity to watch activity or capture sensitive content.

The result is a campaign that can move from a fake installer to account takeover and surveillance. The findings fit a broader rise in AI-themed malware delivery.

In another case, a weaponized ChatGPT download site used sponsored results and fake download choices to target both Mac and Windows users. Familiar branding lowers suspicion when people are looking for new tools or quick fixes.

Users should avoid sponsored links when downloading software and go to a vendor’s official website by typing the address or using a trusted bookmark.

They should never paste a command from a web page, chat, ad, or support message into Terminal unless they fully understand it and have independently verified its source.

Security teams should block the listed infrastructure, investigate unexpected command-line activity launched from browsers, and check Macs for unfamiliar launch items and permission requests.

Resetting passwords alone may not be enough after an infection; affected users should revoke active sessions, rotate exposed keys, and have the device examined for persistence.

Indicators of compromise (IoCs):-

Type	Indicator	Description
File name	9ff32f7c0108e9d27a3b491edf04827b6ca025f44db	Identified MacSync Mach-O sample file name
SHA-256 hash	9ff32f7c0108e9d27a3b491edf04827b6ca025f44db68a	MacSync sample hash reported by SEQRITE
MD5 hash	9678f71ea4cccbc3d511dc8d7f24b113	MacSync sample MD5 hash
SHA-1 hash	59508d071661ea70fa5fcbe6f9e2fb72506e57df	MacSync sample SHA-1 hash
Code-signing identifier	com.utils.Launcher	Ad-hoc-signed MacSync stager identifier
CDHash	d182eb7cba0ffa42d770d7b0d3499e49f24163a2	Code directory hash associated with the sample
Staged archive	/tmp/osalogging.zip	Temporary archive used to hold collected data
Status file	/tmp/.httpcode	Temporary file used to record server response status
Persistence file	com.google.keystone.plist	Possible renamed LaunchAgent persistence file
Persistence file	com.apple.sync.plist	Possible renamed LaunchAgent persistence file
C2 domain	drivinguber.com	Primary command-and-control host
C2 domain	asia.newsinweb.com	Regional fallback command-and-control host
C2 domain	usa.newsinweb.com	Regional fallback command-and-control host
C2 root domain	newsinweb.com	Root domain used for fallback infrastructure
Download URI	/dynamic?txd=c4f70f37daae63fe47b0c92adf006f8cf50b6c522	Path used to retrieve the in-memory AppleScript payload
Upload URI	/gate?buildtxd=c4f70f37daae63fe47b0c92adf006f8cf50b6	Path used for stolen-data uploads
HTTP request header	api-key: de62a2f47d1c7dec2997f931a050a615	API key observed in MacSync network requests
HTTP User-Agent	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) CFN AppleWebKit/537.36	User-Agent string used in command-and-control communications

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.