Huntress Uncovers MacSync: Six‑Stage macOS Stealer via Fake Claude Install Guide
Researchers at Huntress reverse‑engineered MacSync, a new macOS malware family that uses a counterfeit Claude AI install page to trick users into running a curl command. The loader unfolds a six‑stage chain that steals browser credentials, keychain secrets, crypto wallets and installs a native RAT, bypassing Gatekeeper and demanding full‑disk access.