Hackers abuse Google adverts, Claude.ai chats to push Mac malware
Private detective
Attackers are abusing Google Advertisements and first rate Claude.ai shared chats in an active malvertising advertising and marketing campaign.
Users procuring for “Claude mac download” would possibly maybe maybe also just stumble upon backed search outcomes that list claude.ai because the target web space, however lead to instructions that set up malware on their Mac.
Google’s backed search outcome for ‘claude download mac’
(BleepingComputer)
Private detective Shared Claude Chats weaponized to dwelling macOS users
The advertising and marketing campaign became as soon as seen by Berk Albayrak, a security engineer at Trendyol Community, who shared his findings on LinkedIn.
Researcher alerts of ongoing malvertising advertising and marketing campaign
Albayrak identified a Claude.ai shared chat that items itself as an first rate “Claude Code on Mac” installation data, attributed to “Apple Support.”
The chat walks users by procedure of opening Terminal and pasting a expose, which silently downloads and runs malware on their Mac.
While making an try to verify Albayrak’s findings, BleepingComputer landed on a 2ndshared Claude chat finishing up the the same assault by procedure of entirely separate infrastructure.
The 2 chats educate an the same constructing and social engineering formulation however utilize utterly different domains and payloads. Each and every chats were publicly accessible on the time of writing:
Shared Claude Chat with malicious instructions
(BleepingComputer)
Private detective What does the macOS malware attain?
The base64 instructions shown in the shared Claude chat download an encoded shell script from domains comparable to:
In variant seen by Albayrak[[VirusTotal]: hxxp://customroofingcontractors[.]com/curl/b42a0ed9d1ecb72e42d6034502c304845d98805481d99cea4e259359f9ab206e
In variant seen by BleepingComputer[[VirusTotal]: hxxps://bernasibutuwqu2[.]com/debug/loader.sh?produce=a39427f9d5bfda11277f1a58c89b7c2d
The ‘loader.sh’ (served by the 2nd hyperlink above) is another predicament of Gunzip-compressed shell instructions:
Base64 code retrieves first stage ‘loader.sh’ payload
(BleepingComputer)
This compressed shell script runs entirely in memory, leaving runt obvious be aware on disk.
BleepingComputer seen the server serving a uniquely obfuscated version of the payload on each and every quiz (a intention identified as polymorphic provide), making it tougher for security instruments to flag the download in line with a identified hash or signature.
The variant BleepingComputer identified begins by checking whether the machine has Russian or CIS-put keyboard enter sources configured. If it does, the script exits with out doing something, sending a smooth cis_blocked living ping to the attacker’s server on its formulation out. Handiest machines that dash this take a look at rep the next stage:
Forward of persevering with additional, the script moreover collects the sufferer’s external IP tackle, hostname, OS version, and keyboard locale, sending all of it aid to the attacker. This extra or much less sufferer profiling before payload provide suggests the operators are being selective about who they target.
The script then pulls down a 2nd-stage payload and runs it by procedure of osascript, macOS’s constructed-in scripting engine. This presents the attacker some distance-off code execution with out ever losing a venerable utility or binary.
The variant identified by Albayrak, alternatively, appears to skip the profiling steps. It goes straight to execution.
It harvests browser credentials, cookies, and macOS Keychain contents, programs them up, and exfiltrates them to the attacker’s server. Albayrak identified this as a variant of the MacSync macOS infostealer:
Albayrak’s variant skips user fingerprinting step
(BleepingComputer)
The briskinternet[.]com domain shown above in the variant identified by Albayrak looked to be down on the time of writing.
Private detective When the first rate URL is the probability
Malvertising has become a recurring provide mechanism for malware.
BleepingComputer has previously reported on equivalent campaigns concentrated on users procuring for tool admire GIMP, where a convincing Google ad would list a sound-attempting domain however take company to a lookalike phishing space instead.
This advertising and marketing campaign flips that, as there will not be any longer any faux domain to situation.
Each and every Google adverts seen here show Anthropic’s precise domain, claude.ai, since the attackers are web hosting their malicious instructions internal Claude’s comprise shared chat feature. The destination URL in the ad is staunch.
It is no longer, alternatively, basically the indispensable time that attackers comprise abused AI platform shared chats this formulation. In December, BleepingComputer reported a equivalent advertising and marketing campaign concentrated on ChatGPT and Grok users.
Users can comprise to restful navigate straight away to claude.ai for downloading the native Claude app, rather then clicking backed search outcomes. The first rate Claude Code CLI is obtainable on the market by procedure of Anthropic’s first rate documentation and would no longer require pasting instructions from a chat interface.
It is just correct observe to every so incessantly treat any instructions asking you to stick terminal instructions with caution, in spite of where those instructions seem to shut aid from.
BleepingComputer reached out to Anthropic and Google for comment before publishing.
