• Huntress reverse-engineers MacSync, a six-stage macOS stealer and remote access Trojan delivered through a fake Claude Code install guide hosted on a real claude.ai share URL and promoted via a paid Google ad
• The lure needed almost no forgery: the page sat under Anthropic’s own certificate, and the platform’s safety banner repeated the attacker’s chosen display name, “Apple Support,” back to the reader as fact
• The final stage rewrites installed Ledger and Trezor apps in place so a normal launch leads to a fake recovery message that harvests the seed phrase, draining the wallets of unsuspecting victims

Looking online for instructions on how to install Claude Code on a Mac could lead to you having your crypto wallet hijacked in the…