Fortress AI How a fake Claude Code install guide delivered the MacSync malware A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer. Rajesh TV , Vishal Panchani , and Rotimi Akinyele Jul 27, 2026 2 Share Searching “how to install Claude Code on Mac” this week returned what appeared to be the perfect result: a sponsored Google ad pointing to a genuine claude.ai page with a clean installation guide shared by “ Apple Support ”. Nothing about it looked suspicious. The domain was legitimate, the interface was authentic, and even the command itself revealed little at first glance. Behind that guide, however, was a live MacSync malware campaign . MacSync is a macOS infostealer designed to steal credentials, browser sessions, developer secrets and cryptocurrency wallet data. Instead of exploiting software vulnerabilities or compromising Anthropic’s infrastructure, the attackers exploited trust itself. A Base64-obfuscated shell command concealed the real download location, while legitimate platforms and familiar brands bypassed the checks that security-conscious developers are taught to perform. We traced the campaign from the Google ad through to its delivery infrastructure, decoded the hidden command, mapped its command-and-control endpoints, and correlated the indicators with CrowdStrike Intelligence and public reporting. What emerged was one of the most convincing software-installation lures we’ve analysed: a campaign that demonstrates why checking the domain alone is no longer enough. There was no browser exploit, phishing email or compromised website involved. The entire attack relied on a routine developer workflow: searching for software, clicking the first result and following the installation instructions. That’s precisely what makes it so effective and so dangerous. At a glance Attack type: Google Ads malvertising Target: People searching for how to install Claude Code on macOS Lure: A legitimate claude.ai/share page presented as an installation guide Malware: MacSync, a macOS infostealer Delivery method: A Base64-obfuscated shell command that hides the real download URL Primary risks: Theft of passwords, browser sessions, SSH keys, cloud credentials, developer tokens and cryptocurrency wallets Why it worked: The campaign used a real Claude domain, a familiar interface and trusted brand cues to bypass normal security checks What we did: Traced the ad, decoded the command, mapped the infrastructure and validated the indicators against CrowdStrike Intelligence and public reporting The fake Claude Code Google ad The top result for the search “how to install Claude Code on Mac” was a sponsored Google ad with the headline “Claude Code Mac” and a displayed domain of claude.ai . Directly beneath it, Google’s AI Overview and Anthropic’s official documentation showed the legitimate installation command: curl -fsSL https://claude.ai/install.sh | bash The placement mattered. A user scanning the page from top to bottom would encounter the sponsored result first, and every visible signal suggested that it led to the genuine vendor. Join us How the attackers used a legitimate Claude page Following the ad led to a genuine claude.ai/share/... page, not a lookalike site. The domain was real, the Claude interface was authentic, and the conversation was titled “Running Claude Code on Mac” , attributed to “Shared by Apple Support” . That created two powerful trust signals at once: a legitimate Claude page and a familiar brand name. Both were technically genuine, but together they were used in a misleading context. We confirmed that this was the ad’s actual landing page because the URL included Google Ads click-tracking parameters, including gclid and gad_campaignid=23936394455 . How the fake Claude Code installer hides its destination The command relies on two shell features that make it look less revealing than it really is: Base64 encoding and command substitution. Base64 is an encoding format used to represent text as a different string of characters. It is not encryption, but attackers often use it to hide URLs, commands and other readable values from casual inspection. Command substitution, written as $(...), tells the shell to run the command inside the brackets first and replace it with the resulting output before executing the rest of the command. curl -kfsSL $(echo ‘<base64>’ | base64 -D) The shell first runs the inner echo ... | base64 -D pipeline, decodes the hidden string and substitutes the decoded result into the surrounding curl command as the destination URL. That means the URL is never visible in the command as written. The command is not a conventional curl | sh chain, but it still conceals the remote server until the Base64 string is decoded. In a process view, base64 -D and curl may appear as separate processes because the decoding happens before the network request is made. We decoded it....