ClaudeFix: Shared Claude Chats Meet ClickFix
ID: 015f312a-b601-5a53-a76d-b72b2410fc41
STIX ID: report--015f312a-b601-5a53-a76d-b72b2410fc41
Feed Name: Zscaler Security Research Blog
Threat Score
Malvertising campaign observed June 12–19, 2026 delivering the MacSync Stealer to macOS victims via poisoned Google ads linking to shared Claude chats; infection uses base64-obfuscated curl commands that pipe staged zsh/appleScript payloads to memory, collects keychains, browser data, cloud credentials, crypto wallet files, and exfiltrates them in chunks to attacker-controlled domains, with persistence and attempts to trojanize Ledger/Trezor apps.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.