Detailed Analysis
Security researchers at Huntress have uncovered a sophisticated malvertising campaign that exploits the popularity of Claude, Anthropic's AI assistant, to distribute a multi-stage malware payload targeting macOS users. The attack begins with malicious Google Ads that lure victims searching for information on how to install Claude.AI, directing them to a convincing fake installation guide. Rather than delivering a traditional downloadable installer, the malicious page instructs users to copy and paste a curl command directly into their terminal—a technique that cleverly sidesteps macOS's built-in security protections like Gatekeeper, which typically scrutinizes downloaded applications but does not intervene when users manually execute shell commands.
The technical sophistication of this campaign is notable for its six-stage infection chain, which culminates in the deployment of both an information-stealing trojan and a remote access tool (RAT) on the victim's machine. This layered approach allows the attackers to first establish persistence and evade detection before escalating to more invasive capabilities, such as harvesting credentials, browser data, cryptocurrency wallet information, and other sensitive data, while simultaneously granting remote operators ongoing access to the compromised system. The use of a terminal-based delivery mechanism rather than a standard app bundle reflects a growing trend among threat actors to exploit the trust users place in command-line instructions, particularly among technically inclined users who are more likely to be early adopters of AI tools and thus more susceptible to this specific lure.
This incident underscores a broader and increasingly urgent problem: as AI tools like Claude, ChatGPT, and others surge in mainstream adoption, they have become prime targets for social engineering and brand impersonation attacks. Threat actors are capitalizing on the rush of new users—many of whom are unfamiliar with legitimate installation procedures for AI software—by creating convincing fake guides, malicious ads, and typosquatted domains that mimic official resources. Google Ads, despite platform policies against malvertising, remains a persistent vector for these campaigns because paid search results often appear above organic results and can lend an air of legitimacy to malicious sites, especially when users are searching for setup instructions for unfamiliar software.
For Anthropic, this development highlights an ongoing challenge that extends beyond the company's direct control: protecting its brand and user base from impersonation-based attacks that exploit its growing name recognition. As Claude's user base expands and enterprise adoption increases, the incentive for cybercriminals to spoof Anthropic's branding will likely grow in parallel. This mirrors patterns seen with other major tech and AI brands, where popularity directly correlates with attractiveness as an impersonation target. The incident also serves as a cautionary tale for the broader AI industry about the risks of copy-paste terminal commands as an installation method, a practice that, while common in developer communities for legitimate software, creates an exploitable trust gap that security-conscious users and companies alike need to address through clearer official guidance, domain verification, and user education campaigns.
Read original article →