Google Ads as Malware Delivery: The MacSync Stealer Case

"…ready to be sent out over the internet in small pieces." — from the Beelzebub Labs analysis, quoted in CyberPress, 1 July 2026

It starts with a Google search. Someone types "claude code mac install" — a developer, a DevOps engineer, a data scientist, one of the growing group for whom Anthropic's terminal tool is as routine as git or jq. The top result is a sponsored ad titled "Install Claude macOS", sitting above the genuine Anthropic listing. It points not to anthropic.com but to a Google Sites page with a fabricated download counter and a "copy command" button placed exactly where a real install instruction would be.

The chain, in six phases

Giovanni Braccini of Beelzebub Labs traced the sequence from that first click through to the theft of a Ledger recovery phrase. What emerges is less a piece of malware than an assembly line:

1. A paid ad impersonates the legitimate tool.
2. It leads to a cloned install page built to evade automated scanning.
3. The page delivers a Base64-obfuscated terminal command.
4. The command triggers a fake system dialog that captures the macOS login password.
5. With the password in hand, bulk credential harvesting runs immediately.
6. If a Ledger application is present, the attacker persistently takes over the wallet app itself.

Why the attack fits current devtool culture so well

First: Google Sites renders through JavaScript. To a scanner that fetches a URL and reads the delivered HTML, the attack page looks like an empty template. The chain only exists after JS execution. Filtering devtool downloads through an HTTP-fetch scanner catches none of it.

Second: the attack has nothing to do with Anthropic. Claude Code is the lure, but the pattern works against any tool whose official install page says "paste this command in your terminal" — most of the modern landscape, from Homebrew and uv through pnpm, nvm and deno. The internal build tag claude1 shows the template rebrands at will.

Third: priming beats awareness. The page carries an illustrated walkthrough for people who have never opened Terminal. One screenshot of a successful session contains the line "Write admin password: **** ✓". At that point nothing has been installed and nothing typed — but the victim has been shown in advance that entering their password is part of the process. When the real dialog appears minutes later, it does not read as a red flag. It reads as step four of six.

What the stealer does

The copied command pulls a small script, which pulls a larger compressed script, which finally launches the payload: an AppleScript program identifying itself internally as "MacSync Stealer", version 1.1.2.

Its first move is to force-quit Terminal, removing the command from visible history. Its second is the decisive one: it draws a dialog that matches a genuine macOS system prompt pixel for pixel, down to Apple's lock icon. Each attempt is verified in the background through a quiet system command that raises no security alert, so it can simply wait until the correct password is typed.

That password is the master key. It opens the encrypted keychain file and the vault where Chrome and other Chromium browsers store every remembered password. From there the malware works a checklist: more than a dozen browsers, dozens of cryptocurrency extensions, SSH and cloud credentials, Telegram sessions, Apple Notes, and anything sensitive under ~/Desktop, ~/Documents and ~/Downloads.

Worth knowing for the aftermath: refusing a later legitimate keychain permission prompt prevents nothing. By then the attacker holds the raw keychain file and the password to open it offline.

The Ledger time bomb

For most victims it ends there. If Ledger Live or Ledger Wallet is installed, the attack becomes patient.

Rather than hunting for the seed phrase immediately — which would not work against a hardware wallet anyway — the stealer replaces a core file inside the wallet application and re-signs the app so macOS does not flag it as broken. The victim's genuine Ledger application becomes the delivery mechanism.

Inside that altered file sits a single injected line, marked with a Russian-language comment meaning "insert here" — a strong indication of a reusable criminal template rather than bespoke work. Five seconds after the real app opens, long enough to look normal, that line swaps the entire window for a fake error screen built from Ledger's own official artwork, asking the user to re-enter their seed phrase.

Almost every element is built against a specific form of suspicion: automated scanners against the JavaScript lure page, human suspicion against the pre-empted password prompt, signature matching against variable names randomised on every build.

The built-in design flaw — and what it means for response

One detail saves victims by accident. Both the data upload and the Ledger takeover sit behind a final popup: a fake error claiming the Mac "does not support this application". The controlling script halts completely there and cannot continue until someone dismisses it.

In practice: anyone who closes the laptop, force-quits Terminal or restarts the Mac before dismissing that popup never has their data uploaded and never has their wallet app touched. The temporary folder holding the collected material is wiped automatically at next boot.

For first-line triage of a suspected case, that is the single most important question: was the error dismissed? It separates a near miss from total loss.

Either way, change the Mac password and rotate every credential saved in the browser — including when it is unclear whether the final dialog was clicked.

What this means operationally

1. Malvertising has reached the devtool market. Its traditional targets were Windows home users: fake Zoom, fake Teams, fake Chrome. The MacSync case shows the economics now work for macOS developers too — high purchasing power, a plausibly wallet-adjacent audience, thinner EDR coverage than on managed Windows endpoints.
2. curl … | sh is a systemic risk. Not the individual ad, but the habit of copying terminal commands off landing pages unexamined. Internal tooling belongs in packaged distribution: your own Homebrew tap, an apt repository, versioned container images. Any command containing a long encoded string is a stop sign.
3. DNS and ad filtering beat EDR signatures here. The stages phone home to oklahomawarehousing.com. Endpoint DNS with reputation data catches freshly registered domains before any signature exists — and signatures perform poorly here anyway, since variable names change with every build.
4. Ledger app integrity is verifiable. codesign --verify --deep --strict against the installed application flags the re-signing, because the attackers' team-ID certificate does not match the original. A ten-line shell script as a monthly cron job on every corporate Mac costs nothing.

For organisations whose staff hold crypto assets, this is no fringe case under MiCA: custodians, secondary trading, corporate wallets at Web3 firms. Anyone using a Ledger as company cold storage is one compromised developer laptop away from putting everything on the table.

What goes into our threat feed

The documented indicators — dropper SHA-256 bd348a40261aa2d95566ccdc4e6f304ff25aa97d34e5c713c77c937583ad04f0 and the C2 domain oklahomawarehousing.com — go into our MISP push export and are retrievable under intel.neosec.io/ioc/{hash}. For customers with an XIEM connection they roll out through the customer-tier Wazuh instances.

For fast triage of a suspected case, checking the hash against a public sandbox's existing submissions often suffices — it answers in seconds whether this is a known variant of the campaign, before anyone commits to a full manual teardown.

More important than any single hash is the template character. claude1 is a build tag; what the next one says can be guessed with reasonable accuracy.

Bottom line

The problem is not Anthropic, not Google, not Ledger. It is an attack economy in which a single author, on a small ad budget, puts hundreds of developer endpoints within reach in hours. Beelzebub Labs reported the ad and Google removed it within a day — comparable lure pages tend to reappear under new addresses.

What remains is basic discipline: installers only from official documentation or a package manager, encoded strings in a terminal command as a stop sign, DNS reputation taken seriously, the signature of your own Ledger app checked on a schedule. None of it is new. Which is exactly why this attack works.