Full Report
Attackers are already targeting the AI tools your team just started using. Here's what that looks like when it lands in your own environment. And what actually stops it.
Analysis Summary
# Tool/Technique: Fake Claude Code (Infostealer)
## Overview
This attack involves a **Malvertising** campaign that targets developers and AI users by serving malicious "sponsored" search results on Google. The technique impersonates legitimate AI tools—specifically Anthropic’s "Claude Code" CLI—to trick high-value targets (engineers) into downloading and executing malware designed to steal sensitive credentials and source code.
## Technical Details
- **Type:** Infostealer / Malvertising
- **Platform:** macOS
- **Capabilities:** Credential theft (macOS Keychain), Execution of obfuscated scripts, Payload delivery.
- **First Seen:** April 9, 2026 (Reported date)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1589.002 - Gather Victim User Information: Search Engines]
- [T1204.002 - User Execution: Malicious Link]
- **[TA0002 - Execution]**
- [T1059.002 - Command and Scripting Interpreter: AppleScript]
- [T1059.004 - Command and Scripting Interpreter: Unix Shell]
- **[TA0005 - Defense Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1132.001 - Data Encoding: Standard Encoding (Base64)]
- [T1027.002 - Software Packing (Gzip compression)]
- **[TA0006 - Credential Access]**
- [T1555.001 - Steal or Forge Authentication Certificates: Keychain]
## Functionality
### Core Capabilities
- **Deceptive Delivery:** Utilizes Google Sponsored Search results to appear as the primary, trusted download source for "Claude Code."
- **Automated Script Execution:** Upon user execution, an automated shell script initiates the infection chain.
- **Data Encoding/Compression:** Uses **Base64** encoding and **Gzip** compression to hide the script's malicious logic from static analysis.
- **Credential Harvesting:** Specifically targets the **macOS Keychain** to extract stored credentials, with a focus on AI-related service tokens (Claude Code credentials).
### Advanced Features
- **Multi-stage Payload:** The initial script acts as a downloader, pulling a secondary executable payload from a remote server after the environment is deemed suitable.
- **Obfuscated AppleScript:** Uses AppleScript to perform system-level actions while making the process behavior harder for traditional security tools to interpret.
- **Targeted Intelligence:** The malware specifically prioritizes the theft of access to source code and proprietary product data.
## Indicators of Compromise
*Note: Specific hashes and domains were not explicitly provided in the source text.*
- **File Names:** Likely masquerading as `claude-code`, `claude-cli`, or similar installers.
- **Network Indicators:** Malicious "sponsored" domains (e.g., `claude-code[.]download` - *example defanged*).
- **Behavioral Indicators:**
- `curl` or `wget` commands fetching secondary payloads immediately after execution.
- Unexpected `security find-generic-password` or similar Keychain access attempts via AppleScript.
- Execution of shell scripts containing large Base64/Gzip blocks.
## Associated Threat Actors
- Unknown (Campaign identified by Huntress SOC).
## Detection Methods
- **Behavioral Detection:** Monitoring for AppleScript processes attempting to access the Keychain or sensitive system folders.
- **Heuristic Analysis:** Flagging the execution of scripts that utilize layers of Base64 and Gzip compression (Indirection).
- **Network Monitoring:** Alerting on downloads of executable files from newly registered or high-risk domains originating from "sponsored" search clicks.
## Mitigation Strategies
- **Prevention Measures:**
- Implement an **Ad-Blocker** at the browser or DNS level to hide sponsored search results.
- Educate staff to skip "Sponsored" results and look for official `https://github.com` or `https://anthropic.com` URLs.
- **Hardening Recommendations:**
- Enforce **EDR/MDR** solutions that monitor AppleScript and shell activity on macOS.
- Implement **Credential Rotation** policies for AI API keys and developer tokens.
- Foster a "no-blame" culture to encourage immediate reporting of accidental clicks.
## Related Tools/Techniques
- **Celestial Stealer:** Another infostealer mentioned as active in the same timeframe.
- **SEO Poisoning:** The broader category of manipulating search results to distribute malware.
- **Evilginx:** Mentioned as a tool researched by similar threat actors for bypassing MFA.