Fake Claude Install Guide Leads to MacSync Stealer and RAT: What We Pulled From the Attacker’s Servers

A Google ad for a fake Claude install guide led to a sophisticated, multi-stage MacSync malware attack that stole passwords, browser data, and cryptocurrency wallet secrets—including by trojanizing existing wallet apps—using a blend of social engineering, server-side scripting, a persistent RAT, and infrastructure designed to evade detection and maximize irreversible financial theft.