ClickFix Attack Targets Devs with MacSync Malware via Fake Claude Tools
Researchers at 7AI uncovered the Claude Fraud campaign, which uses fake AI tool extensions and Google ads to distribute MacSync malware targeting developers. The attack tricks macOS and Windows users into executing malicious commands via convincing fake websites and VS Code plugins, compromising Keychain credentials, browser cookies, and crypto wallets, affecting over 15,600 victims.
AI summary of the linked source. Not reviewed by an editor. How this works
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — MacSync
- malware — CrossMark2
- malware — Claude Fraud