Fake Claude guides target Mac developers

Mac developers searching for Claude Code are being steered by sponsored Google results to fake setup guides that deliver the MacSync infostealer; Huntress’s incident analysis identifies a 6-stage campaign built around a legitimate shared Claude page. The report says the malware sought browser credentials, keychain secrets, cloud and SSH configuration, and crypto-wallet access, while Cato’s parallel account describes the same abuse pattern around fake Codex downloads. Teams should treat copy-pasted install instructions and AI-hosted guides as a supply-chain boundary, reinforcing the archive’s hard-deny case for coding-agent permissions.