EN PT-BR
← Voltar ao feed
high cryptocurrency technology

Fake Claude download pages on claude.ai, promoted via Google Ads, deliver AMOS stealer on macOS and a RAT-like payload on Windows

1 fonte(s) · 1 atualização(ões) · publicado 27/10/2026 07:53 · coletado há 5 dias

Attackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic's legitimate claude.ai domain, abusing Shared Chats (claude.ai/share/) and public Artifacts (claude.ai/artifact/). Anthropic's infrastructure is not compromised. The pages copy Claude's branding and persuade victims to run commands themselves (ClickFix). Gen Digital researchers identified separate macOS and Windows campaigns aimed at credential theft, cryptocurrency theft and remote access. The macOS chain ends in Atomic macOS Stealer (AMOS), and the Windows chain delivers a packed .NET payload with remote-access behavior.

Detalhes técnicos

  • Analyzed links carried Google advertising parameters (gclid, gad_campaignid). Multiple Artifacts were tied to two ad campaigns, which suggests a rotating distribution operation. One lure was a shared chat titled "Claude Code on Mac".
  • macOS: the page offers a "Quick install via Terminal" workflow whose copy button supplies an obfuscated command. A loader fetches and unpacks a further script, which downloads and runs an AppleScript-based AMOS payload.
  • AMOS checks for Full Disk Access. Without it, the malware shows a fake access request and modifies a shell startup file so it runs again when Terminal next opens. It then shows a fake macOS password dialog that repeats until the victim enters a valid password.
  • AMOS harvests browser passwords, session cookies, Keychain material, cryptocurrency wallets and documents. It compresses them into a ZIP, uploads the archive to attacker infrastructure and cleans up temporary files.
  • If Ledger Live, Ledger Wallet or Trezor Suite is installed, AMOS can replace it with a trojanized version. Fake "restore" or "validate" prompts then collect recovery phrases and send them to a separate server.
  • Windows: another Claude Artifact tells victims to use Win+R, Ctrl+V and Enter. The pasted PowerShell command shows reassuring progress messages and retrieves the next stage from a github.io page containing an encrypted, packed .NET payload.
  • The payload injects into a legitimate Windows process, checks installed antivirus products, takes screenshots, reads active window titles and keeps a connection to the attacker. It also searches for desktop wallets and browser wallet extensions. Researchers describe it as remote-access tooling rather than a single-purpose stealer.

Remediação

  • Download Claude only from the official page, claude.com/download, never from shared conversations or Artifacts.
  • Do not run commands copied from advertising-linked installation prompts.
  • Treat any endpoint that ran these commands as compromised: revoke sessions, reset credentials from a clean device, and replace exposed wallet recovery phrases immediately.

Linha do tempo

  1. gbhackers.com ↗ · pub. 27/10/2026 07:53 · coletado 27/10 09:00 primeiro registro

    Fake Claude download pages on claude.ai, promoted via Google Ads, deliver AMOS stealer on macOS and a RAT-like payload on Windows

    ler a análise desta fonte

    Attackers are buying Google Ads to promote fake Claude download pages hosted on Anthropic's legitimate claude.ai domain, abusing Shared Chats (claude.ai/share/) and public Artifacts (claude.ai/artifact/). Anthropic's infrastructure is not compromised. The pages copy Claude's branding and persuade victims to run commands themselves (ClickFix). Gen Digital researchers identified separate macOS and Windows campaigns aimed at credential theft, cryptocurrency theft and remote access. The macOS chain ends in Atomic macOS Stealer (AMOS), and the Windows chain delivers a packed .NET payload with remote-access behavior.

    Technical Details

    • Analyzed links carried Google advertising parameters (gclid, gad_campaignid). Multiple Artifacts were tied to two ad campaigns, which suggests a rotating distribution operation. One lure was a shared chat titled "Claude Code on Mac".
    • macOS: the page offers a "Quick install via Terminal" workflow whose copy button supplies an obfuscated command. A loader fetches and unpacks a further script, which downloads and runs an AppleScript-based AMOS payload.
    • AMOS checks for Full Disk Access. Without it, the malware shows a fake access request and modifies a shell startup file so it runs again when Terminal next opens. It then shows a fake macOS password dialog that repeats until the victim enters a valid password.
    • AMOS harvests browser passwords, session cookies, Keychain material, cryptocurrency wallets and documents. It compresses them into a ZIP, uploads the archive to attacker infrastructure and cleans up temporary files.
    • If Ledger Live, Ledger Wallet or Trezor Suite is installed, AMOS can replace it with a trojanized version. Fake "restore" or "validate" prompts then collect recovery phrases and send them to a separate server.
    • Windows: another Claude Artifact tells victims to use Win+R, Ctrl+V and Enter. The pasted PowerShell command shows reassuring progress messages and retrieves the next stage from a github.io page containing an encrypted, packed .NET payload.
    • The payload injects into a legitimate Windows process, checks installed antivirus products, takes screenshots, reads active window titles and keeps a connection to the attacker. It also searches for desktop wallets and browser wallet extensions. Researchers describe it as remote-access tooling rather than a single-purpose stealer.

    Remediation

    • Download Claude only from the official page, claude.com/download, never from shared conversations or Artifacts.
    • Do not run commands copied from advertising-linked installation prompts.
    • Treat any endpoint that ran these commands as compromised: revoke sessions, reset credentials from a clean device, and replace exposed wallet recovery phrases immediately.