Fake Claude Installation Guides Used to Spread MacSync Malware on macOS Cybercriminals are leveraging fake installation guides for the AI assistant Claude to distribute MacSync, a sophisticated information stealer and remote access trojan (RAT) targeting Mac users. The campaign exploits sponsored Google search results and a publicly shared page on claude.ai, making the malicious links appear legitimate. ### How the Attack Unfolds A victim searching for "How to install Claude Code on a Mac" clicked a paid Google ad redirecting to a Claude-branded conversation disguised as "Apple Support." The page instructed users to paste a command into Terminal, which instead downloaded and executed malware. The attack relies on social engineering victims manually run the malicious command, which uses curl to fetch an obfuscated payload piped directly into Z shell (zsh). The first-stage loader is a Base64-encoded, gzip-compressed zsh script, with variations between victims to evade simple hash-based detection. ### Malware Capabilities & Data Theft Once executed, MacSync fetches AppleScript from attacker-controlled servers, running it in memory to avoid disk-based detection. The malware then requests Full Disk Access, a high-privilege macOS permission, and displays a fake system dialog to capture the user’s Mac account password validated via dscl to ensure accuracy. MacSync exfiltrates a wide range of sensitive data, including: - Browser cookies & saved logins - Keychain data & SSH keys - Cloud credentials & Telegram session data - Safari history & Apple Notes - Files from common user directories - Chromium "Safe Storage" keys (used to decrypt browser credentials) Stolen data is compressed into /tmp/osalogging.zip, uploaded to attacker infrastructure, and deleted from the victim’s system. ### Persistence & Remote Access The malware installs a Mach-O RAT via a LaunchAgent, enabling: - Remote shell access - Command execution - File transfer - Additional data theft A separate helper app attempts to gain Screen Recording permission, allowing the RAT to capture screenshots and transmit them to the attackers. ### Cryptocurrency Wallet Targeting MacSync also scans for dozens of cryptocurrency wallet browser extensions and desktop apps, including hardware-wallet companion software. It replaces legitimate wallet apps with trojanized versions, tricking users into entering seed phrases which, once stolen, grant attackers full control over wallets without requiring the original hardware. The campaign highlights the growing sophistication of macOS malware, combining social engineering, in-memory execution, and multi-stage payloads to evade detection while maximizing data theft.

Critical macOS CUPS Vulnerability (CVE-2026-39875) Exploited via Public PoC A proof-of-concept (PoC) exploit has been released for CVE-2026-39875, a high-severity macOS vulnerability in the Common UNIX Printing System (CUPS) that enables local privilege escalation via arbitrary file writes with root privileges. The flaw affects macOS Sonoma, Sequoia, and Tahoe versions prior to 14.8.8, 15.7.8, and 26.6, respectively. Discovered by security researcher Dallas Dubs, the exploit chains two logic flaws in the privileged `cupsd` daemon. An unprivileged local attacker can register a malicious printer, steal a valid CUPS authentication token during probing, and replay it to create a second printer with a `file://` device URI targeting an attacker-controlled path bypassing System Integrity Protection (SIP). The attack culminates in submitting a print job with controlled data, which `cupsd` writes to the specified location as root. The PoC, available on GitHub, confirms root-owned file creation but does not directly provide a full interactive shell. However, arbitrary file writes can facilitate privilege escalation by modifying sensitive files (e.g., configurations, scheduled tasks, or application support files), depending on system defenses. The exploit requires no user interaction and has been demonstrated on macOS Tahoe 26.4.1, Sequoia 15.7.5, and Sonoma 14.8.5. While the impact varies based on SIP restrictions and endpoint security controls, the vulnerability poses a significant risk to shared Mac systems, developer endpoints, and environments where untrusted local code execution is possible. Apple has patched the flaw in the latest macOS updates (26.6, 15.7.8, and 14.8.8). Security teams are advised to monitor for unusual printer registrations, suspicious print jobs targeting file-based destinations, and unexpected changes to printer device URIs as potential indicators of exploitation. The public PoC increases the likelihood of active testing and attacks, underscoring the urgency of patch deployment.