Google Ads as Malware Delivery: The MacSync Stealer Case

"Everything gets zipped into a single archive, ready to be sent out over the internet in small pieces." — Beelzebub Labs analysis, quoted in Lucas Martin, "Fake 'Claude Code' Google Ad Delivers MacSync Stealer, Hijacks Ledger Wallets on macOS", CyberPress, 1 July 2026

It starts with a Google search. Someone types "claude code mac install" — a developer, a DevOps engineer, a data scientist, someone from the growing group for whom Anthropic's terminal tool is as everyday as git or jq. The top result is a sponsored ad. And it points not to anthropic.com, but to a Google Sites page with a fake download counter, a "copy command" button, and reassuring screenshots of a terminal session where everything happens exactly the way it's supposed to.

Except then it doesn't. The copied Base64 command unpacks into a script that downloads the MacSync Stealer. Within seconds, the keychain, the Chromium password vault, SSH keys, cloud tokens, Telegram sessions, Apple Notes, and everything under ~/Desktop, ~/Documents, ~/Downloads are in a single ZIP archive. Anyone with a Ledger wallet app installed sees, five seconds after the next launch, a fake error screen with the correct Ledger branding, asking for a seed phrase re-entry.

The campaign was analyzed by Beelzebub Labs and detailed in a CyberPress report on 1 July. Google removed the ad within 24 hours. New domain, new page, same flow — that is the analyst forecast, and it is realistic.

Why this attack fits the post-2025 devtool culture so well

Three observations from the report deserve more attention than they will get in most threat feeds.

First: Google Sites renders via JavaScript. For security scanners that fetch a URL and read the HTML payload — VirusTotal, SafeBrowsing crawlers, internal SOC tools — the attack page looks like an empty Google Sites template. The actual attack chain exists only after JS execution. Anyone filtering devtool downloads through an HTTP-fetch-based scanner today does not see it.

Second: The attack is not specific to Anthropic. Claude Code is the lure, but the pattern works with any devtool whose official install page says "paste this command in your terminal" — meaning practically the entire modern tool landscape from Homebrew and uv to pnpm, nvm, and deno. The attackers have a template that can be rebranded at will. The internal payload tag "claude1" gives away the templatization.

Third: Priming replaces permission-prompt awareness. One screenshot on the fake landing page shows a terminal session with "Write admin password: **** ✓". Anyone who has seen that is mentally prepared to see a password dialog next — and types it without hesitation. Awareness training that preaches "watch for password prompts" does not help precisely when the user is expecting the prompt.

The genuinely uncomfortable part: the Ledger injection

The standard part of the attack — credential harvest, ZIP upload — is craft. The Ledger part is craftsmanship.

Rather than pulling the seed directly from memory (which would not work against a hardware wallet anyway), the stealer replaces core files in the Ledger application and re-signs the app to bypass Apple's integrity check. On next launch the manipulated version runs, waits five seconds, then swaps in a fake error screen with the correct Ledger design and requests the seed for "recovery". A Russian-language comment in the injected code — "insert here" — points to a reusable malware template probably already in use against multiple wallet brands.

This is the attack a CISO whose team manages crypto assets for the employer should fear. And in Germany under MiCA (in force since early 2025) this is no longer a fringe scenario: custody providers, crypto secondary trading, corporate wallets at Web3 firms, blockchain analytics teams. Anyone using a Ledger as a corporate cold-storage device is a single developer laptop compromise away from putting the entire company on the table.

What this means for Germany concretely

Four observations for German operational reality:

1. Malvertising has arrived in the devtool market. Classic malvertising targets have been Windows home users (fake Zoom, fake Teams, fake Chrome). The MacSync case shows the economics now work for macOS developers too — high target purchasing power, plausibly wallet-adjacent user group, less EDR coverage than corporate Windows endpoints.
2. curl … | sh installers are a systemic risk. Not the single ad, but the culture of copying terminal commands unquestioningly from landing pages. For internal devtools, every company should move to packaged distributions (Homebrew tap, apt repository, versioned Docker images) — not "paste this to install".
3. DNS and ad filters help more than EDR signatures. C2 domain in this case: oklahomawarehousing.com. Newly registered, no legitimate purpose. NextDNS, Pi-hole, Cloudflare Zero Trust — they blocked similar malvertising bursts within an hour last week. Corporate endpoint DNS with reputation feed makes more difference than any signature update round.
4. Ledger app integrity can be checked. macOS codesign --verify --deep --strict against the installed Ledger app flags a re-signing, because the attacker''s team-ID certificate does not match Ledger''s original signature. A ten-line shell script as a monthly cron on every corporate Mac is cheap.

What flows into our threat feed

We will roll the documented IOCs into our MISP push export within the next 24 hours — the dropper SHA-256 and C2 domain are small, clear data points that can deploy to customer-tier Wazuh instances immediately. Anyone who wants direct access under intel.neosec.io/ioc/{hash} with bd348a40261aa2d95566ccdc4e6f304ff25aa97d34e5c713c77c937583ad04f0 can have it starting tomorrow.

More important than the single hash is the template character. "claude1" is a tag inside the payload — what the next tag will be ("cursor1"? "warp1"? "zed1"?) can be guessed with some accuracy. Anyone being asked today which devtool domains to hold on an allowlist for their team has just been handed a very concrete motivation for the answer.

Bottom line

The real problem is not Anthropic, not Google, not Ledger. It is an attack economy in which single malware authors, on a €20 Google Ads budget, can put hundreds of developer endpoints within reach in a few hours — and, in the same campaign, extract five-figure EUR sums from wallets. Beelzebub Labs documented the campaign cleanly; Google removed the ad in 24 hours. Neither of those things changes the likelihood that the next variant goes live this or next week.

What remains is basic discipline: installers only from documented sources, curl … | bash as a red flag, DNS reputation taken seriously, and monthly verification of your own Ledger app signature. None of this is new. Which is precisely why this attack works.

Source (English only): Lucas Martin, "Fake 'Claude Code' Google Ad Delivers MacSync Stealer, Hijacks Ledger Wallets on macOS", CyberPress, 1 July 2026. Technical analysis: Giovanni Braccini, Beelzebub Labs.