Cybercriminals are currently hijacking the hype around Anthropic’s AI tools to infect Apple computers with vicious data-stealing software. We saw a massive spike in malicious Google Ads that trick developers into downloading fake versions of “Claude Code,” only to have their passwords and crypto wallets wiped clean.
This sophisticated campaign, first flagged by security researchers at Bitdefender and Moonlock Lab, reached a critical peak on May 11, 2026.
Our sources confirmed that the hackers are using a sneaky “ClickFix” tactic to bypass traditional security. They create high-ranking “Sponsored” search results that look exactly like official documentation.
“The page closely mirrored the real documentation,” Bitdefender researchers noted while describing how users are lured into a trap. Once a user clicks, they are told to copy and paste a “simple” command into their Mac Terminal to install the software.
Pasting that single line of code is a huge mistake. It immediately triggers a script that downloads the MacSync infostealer, which can grab your Keychain data and browser cookies in seconds.
We talked to experts who noted that over 15,600 victims have already been documented in this specific wave. The malware even tries to replace legitimate apps like “Ledger Live” with fake versions to steal Bitcoin and Ethereum directly from the source.
Google has struggled to keep up because the attackers use verified but compromised business accounts from charities and retailers.
According to a report by SC Media, some of these ads were linked to hijacked accounts from a Canadian children’s charity.
The scale is staggering. One specific “Claude” artifact hosted on the official platform was viewed more than 15,600 times before being taken down. You should never run Terminal commands from a website unless you have verified every single character of that script.
Check out the social media alert below to see what these fake ads look like in the wild.
🚨 macOS malware warning🍎:
Attackers are abusing Google Ads and legitimate https://t.co/5YlWTA7Zr0 shared chats to distribute a #MacSync malware variant via fake “Claude Code on Mac” install steps. The flow:
User searches “Claude download mac” on Google, …@AnthropicAI pic.twitter.com/G0Ir423dfh— Berk Albayrak (@brkalbyrk7) May 9, 2026
Stay safe by only visiting the official domain at claude.ai for any downloads. Digital predators are moving fast, and they are counting on your hurry to get the latest AI tools.
“Avoid sponsored results for software downloads,” Bitdefender warned in their latest bulletin. Double-check every URL before you hit that Enter key on your keyboard.
