Fake Claude Code Install Guide Uses Google Ads to Deliver MacSync Infostealer

Fake Google Ads are being used to push a convincing Claude Code installation guide that delivers the MacSync infostealer to macOS users. The campaign turns an ordinary developer search into a path for credential theft and wider account compromise. The attack starts when a user searches for Claude Code installation help and clicks a sponsored result. The ad appears to lead to Claude’s real website, giving victims little reason to question the guide before copying its terminal command. Analysts from Deriv AI identified that the command conceals its real download location with Base64 encoding. That hidden destination downloads MacSync, which targets passwords, browser sessions, developer credentials, and cryptocurrency wallet...

Read the full article at the source.