Claude LLM artifacts abused to push Mac infostealers in ClickFix attack

Researchers observed threat actors promoting malicious Claude artifacts and impersonated pages via Google Ads to trick macOS users into pasting shell commands that download and execute a MacSync infostealer loader; the malware collects keychain, browser and crypto wallet data and exfiltrates it to a2abotnet.com/gate. The campaign has multiple variants, thousands of recorded views (12k–15.6k+), shared C2 infrastructure, and includes clear IOCs and commands users are instructed to run.