Attackers are abusing Anthropic’s public claude.ai/share pages to trick Mac users into infecting themselves. Huntress says a sponsored Google result for "Claude on Mac" led victims to a claude.ai/share page branded as Apple Support that told them to paste a curl command into Terminal, triggering a six-stage infection chain that installed the MacSync stealer and stole cookies, credentials, Keychain data, Telegram sessions, SSH keys, and cloud secrets.
Why it matters: This matters because the malicious page sits on Anthropic’s real domain, so many users will treat it as trustworthy. Mac users and defenders should be wary of AI-generated install guides, avoid pasting Terminal commands from shared AI pages, and investigate for stolen browser, chat, SSH, and cloud credentials if this lure was used.
Bill Toulas
2026.09.24
88% relevant
This adds new technical detail on the same MacSync malware campaign, showing an updated delivery chain that uses public iCloud calendar event descriptions to fetch payloads and documenting a new Finder-disguised backdoor module with persistence and data-theft capabilities.
Sponsored by Huntress Labs
2026.09.11
100% relevant
The article provides a distinct concrete campaign abusing claude.ai/share links, separate from the tracked FakeAgent Claude Artifact/SectopRAT case and from OpenAI share-link abuse, with a different lure, platform feature, and malware family.
← Back to all stories