At least two variants of a malware installation are floating out there for macOS users. Bleeping Computer has published their initial findings regarding the campaign after having it brought to their attention by Berk Albayrak, a security engineer at Trendyol Group, who posted about the scam on LinkedIn. Amidst the constant abuse of vulnerabilities and supply chain attacks, good old-fashioned malvertising is sneaking in through the noise.
It starts simple, users doing a search for downloading Claude onto their Mac. This campaign utilizes the legitimate site through a sponsored ad before redirecting to a malicious link, itself using a hijacked Claude chat. Users are instructed to open their terminal and copy/paste a command. The first – as seen by Albayrak – downloads an infostealer that harvests browser credentials, cookies, and macOS Keychain contents, packages them up, and exfiltrates them to the attacker's server. While verifying Albayrak’s findings, Bleeping Computer stumbled across a second variant, that includes user profiling as the first step. The profiling is aimed at discovering if the user who clicked on the malicious ad is using a Russian or CIS-region keyboard and, if so, the script does nothing further. Upon successful determination that the profiled user is not, however, it runs an infostealer looking for the victim's external IP address, hostname, OS version, and keyboard locale before sending it to the attacker.
Another detail I spotted while researching this is that the version Albayrak found additionally uses a hijacked URL from a roofing company for the redirect, and is an HTTP link. The version Bleeping Computer found uses an HTTPS link of bernasibutuwqu2[.]com. That one carries a loader.sh as well, which contains a set of Gunzip-compressed shell instructions. Given the secure nature of that link, one can only assume it is also hijacked or spoofed. The two versions are cataloged on Virus Total.
Upon download, both then run a second stage payload through osascript, Mac’s built-in scripting engine. This allows the malware to live off the land, meaning that no physical download file is stored in the hard drive, instead running from the compression in memory. It allows remote code execution without leaving any sign that it’s there, making remediation challenging, as no hash or signature is left behind to be flagged by security tools.
Malvertizing campaigns have largely fallen by the wayside in recent months, but in no way are they a discarded tool of threat actors. Many attacks of this kind use a domain for hosting; this one leverages the genuine URL instead, making it more highly obfuscated. This is not the first time AI tools have been abused in such a way, either. In December, Bleeping Computer reported on a similar scam aimed at ChatGPT and Grok users. And earlier this year another, nearly identical campaign targeted users searching for Homebrew, a package manager.
Users are encouraged to always go directly to a site and download from there, rather than following the instructions of an ad. And never copy/paste a command into the terminal from one, even a sponsored one. Legitimate download of an application does not require that. Stay aware, stay suspicious and remember that your friendly neighborhood WISP is here to help.