Experts warn this fake Claude install guide can be used to empty crypto wallets

A fake Claude Code install guide, hosted on the legitimate claude.ai website and promoted through a paid Google ad, has been found to be capable of emptying crypto wallets. The lure required minimal forgery, as the page was hosted under Anthropic's own certificate and featured a safety banner displaying "Apple Support," which the victim was led to believe was the source of the information.

The six-stage macOS stealer, known as MacSync, was reverse-engineered by security firm Huntress and revealed its malicious intent. The guide, presented as Apple Support documentation, instructed victims to open Terminal and execute a single command. This led to the installation of a trojanized version of their cryptocurrency wallet app, which in turn harvested the seed phrase, resulting in the draining of the victim's wallets.

This sophisticated campaign exploited Anthropic's feature that allows any user to publish a public share URL, which in this case hosted the malicious guide under the guise of Apple Support. The platform's safety banner further reinforced the attacker's credibility, making it difficult for victims to discern the legitimacy of the information.