[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbwf1VmK377tLjh1dH9ATuAl9PLxj2FybU5IWTR2yVqU":3},{"article":4,"iocs":39,"watch_terms":49,"solutions":50,"lesson":10},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":21},"320cb5be-0f52-4077-bd3c-bdb14b060107","ClickFix Attack Targets Devs with MacSync Malware via Fake Claude Tools","clickfix-attack-targets-devs-with-macsync-malware-via-fake-claude-tools","Cybersecurity researchers at 7AI have revealed a new Claude Fraud campaign in which hackers use fake AI extensions and Google ads to steal data from tech professionals.","Researchers at 7AI uncovered the Claude Fraud campaign, which uses fake AI tool extensions and Google ads to distribute MacSync malware targeting developers. The attack tricks macOS and Windows users into executing malicious commands via convincing fake websites and VS Code plugins, compromising Keychain credentials, browser cookies, and crypto wallets, affecting over 15,600 victims.",null,"https:\u002F\u002Fhackread.com\u002Fclickfix-attack-devs-macsync-malware-fake-claude-tools\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002Fnew-malware-claude-fraud-developers-via-fake-claude-ai-apps-and-google-ads.jpg","2026-03-17T15:23:53+00:00","2026-03-17T17:00:13.495175+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":10,"name":19,"slug":20},"Malware","malware",[22,27,32,34],{"category":23},{"id":24,"icon":10,"name":25,"slug":26},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":28},{"id":29,"icon":10,"name":30,"slug":31},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":33},{"id":17,"icon":10,"name":19,"slug":20},{"category":35},{"id":36,"icon":10,"name":37,"slug":38},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[40,43,46],{"type":20,"value":41,"context":42},"MacSync","macOS malware that targets Keychain credentials, passwords, browser cookies, and crypto-wallet keys",{"type":20,"value":44,"context":45},"CrossMark2","Windows second-stage malware deployed via fake VS Code Claude plugin after antivirus is disabled",{"type":20,"value":47,"context":48},"Claude Fraud","Campaign name for the coordinated attack using fake AI extensions and Google ads targeting developers",[],{"controls":51,"vendors":135},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":82,"name":83,"problem":84,"products":85},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",{"slug":111,"name":112,"problem":113,"products":114},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[115,122,129],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":111,"product_name":119,"url":120,"description":121},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":126,"url":127,"description":128},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":130,"product_name":131,"url":133,"description":134},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"7ai","7AI","\u002Fvendor-logos\u002F7ai.png",[141],"reported_by"]