macOS Malware Leverages Google Ads and Legitimate Claude.ai Shared Chats to Deliver Malware

### Executive Summary: Attackers are running a malvertising campaign that leverages paid Google Ads and deceptive Claude AI-themed landing pages hosted on trusted platforms (Google Sites, Framer, claude.ai shared chats) to trick macOS users into executing a MacSync "Clickfix" payload. The campaign redirects victims through rotating domains and IPs (examples include sites.google.com/view/cloud-version-08, claud e-desktop-app.framer.ai, 2.26.75.112/Hokojol, pieoneer.org) to deliver a macOS information stealer that exfiltrates browser credentials, cryptocurrency wallet data, and session tokens; defenders are advised to block known IOCs, monitor macOS endpoint telemetry for unusual script execution from browsers, and educate users to avoid sponsored download ads.