Hackers Abused Claude.ai Shared Chat in a ClickFix Malvertising Campaign

### Executive summary A ClickFix malvertising campaign purchased Google Ads for fake AI tools and hosted lure pages on trusted domains (GitLab Pages and weaponized shared chats on claude.ai) to trick macOS users into pasting Terminal commands that installed the MacSync infostealer; Trend Micro/TrendAI observed over 2,000 interactions, predominantly in Asia-Pacific, with harvested data including browser credentials, cookies, SSH keys, and crypto wallet files, and Anthropic disabled the malicious shared chats after disclosure.