Punto Informatico: Chat condivise di Claude per distribuire malware su Mac

Sfruttando i link sponsorizzati dei motori di ricerca e le chat condivise di Claude, i cybercriminali distribuiscono l'infostealer MacSync per macOS.
The post Chat condivise di Claude per distribuire malware su Mac appeared first on Punto Informatico.

Shared chats of Claude for distributing malware on Macs

Leveraging sponsored links from search engines and Claude’s shared chats, cybercriminals are distributing the info-stealer MacSync for macOS.
The post Claude’s Shared Chats for Distributing Malware on Mac appeared first on Punto Informatico.

#Claude #MacSync #first #PuntoInformatico

https://www.punto-informatico.it/chat-condivise-claude-distribuire-malware-mac/

Chat condivise di Claude per distribuire malware su Mac

Sfruttando i link sponsorizzati dei motori di ricerca e le chat condivise di Claude, i cybercriminali distribuiscono l'infostealer MacSync per macOS.

Punto Informatico
ISC Diary: Malicious ad for Homebrew leads to #MacSync #Stealer https://isc.sans.edu/diary/32942

📢⚠️ Hackers are abusing hijacked Google Ads and fake Claude AI guides in a new #ClickFix attack targeting Mac users. Victims are tricked into pasting malicious Terminal commands that install #MacSync infostealer malware.

Read more: https://hackread.com/google-ads-claude-ai-macsync-malware-clickfix/

#CyberSecurity #macOS #Malware #GoogleAds #ClaudeAI

Google Ads and Claude AI Abused to Spread MacSync Malware via ClickFix

Hackers are using hijacked Google Ads and fake Claude AI guides in a new ClickFix attack to trick Mac users into installing MacSync malware.

Hackread - Cybersecurity News, Data Breaches, AI and More

2025-12-23 (Tuesday): Based on yesterday's Jamf article, I downloaded the fake installer for #MacSyncStealer from zkcall[.]net and ran it on a macOS host in my lab.

A #pcap of the #MacSync #Stealer traffic, the associated IOCs, the #malware sample, and a link to the Jamf article are at www.malware-traffic-analysis.net/2025/12/23/index.html

Of note, the zkcall[.]net download page also has a link for a Windows download. The downloaded EXE file appears to be #DonutLoader, based on one of the follow-up EXE files it retrieved and ran: https://app.any.run/tasks/afd3ae74-2976-492b-a3c0-6e19e9127f68

MacOS : cette version du malware MacSync contourne Gatekeeper

MacOS a été pris pour cible par une nouvelle variante du logiciel malveillant MacSync capable de contourner Gatekeeper, grâce à une application Swift signée.

IT-Connect
New MacSync malware dropper evades macOS Gatekeeper checks

The latest variant of the MacSync information stealer targeting macOS systems is delivered through a digitally signed, notarized Swift application.

BleepingComputer