Somebody typed "how to install Claude Code on a Mac" into Google and clicked the sponsored result at the top. They landed on claude.ai. The domain was genuine, the page was a publicly shared Claude conversation, and whoever shared it had set their display name to "Apple Support". The page told them to paste one curl command into Terminal.
That command was stage one of six.
Huntress SOC analysts Ryan Dowd and Josh Kiriakoff took the campaign apart after one of the company's customers ran it in July and published their walkthrough of the kill chain. The customer powered the machine off as soon as things looked wrong, which normally destroys the evidence, so Kiriakoff rebuilt the loader's request and pulled the payload straight off the attacker's own servers.
The trick is that you type it yourself
This is ClickFix: rather than defeating macOS, the attacker persuades the user to run the command on their own behalf, so there is nothing for Gatekeeper to block. The credibility came from two borrowed things, a legitimate claude.ai URL and the words "Apple Support" on the share badge. We covered the Google Ads and shared-Claude-chat version of this lure in June, and a fake Apple security update running the same play before that. What is new is the payload.
Six stages, and almost nothing on disk
The curl command returns a 1,442-byte zsh script wrapped around a compressed, Base64-encoded payload. Every build differs because it is keyed to the victim token the attacker hands out, so as Kiriakoff put it, you cannot detect on the hash, you have to detect on the behavior. The second stage runs in the background, fetches stage three, uploads the loot archive and deletes the staging file.
Stage three is the interesting one. Its AppleScript is generated by the attacker's server on demand, sits behind an API key gate, and runs in memory without ever touching disk, so the operator can change what it steals from any victim without rebuilding the loader. It opens by asking for Full Disk Access through TCC, the macOS permission system Dowd describes as the guest list at a nightclub: get your name on it and the bouncer waves you through. Once the user accepts and enters their password, the script lifts every browser's Chromium Safe Storage key out of the login keychain, the key that decrypts saved cookies and logins.
Stage four installs a remote access trojan with a LaunchAgent that restores it at every login. It calls out to 85[.]206[.]161[.]241 on port 8443 using its own bundled OpenSSL to sidestep macOS certificate checks. Stage five is a separately signed helper whose only job is to hold the Screen Recording permission, with no network code of its own.
Why the wallets are the real prize
Stage six rewrites and replaces apps the victim already trusts, checked against 60 wallet browser extensions, 21 desktop wallet apps and three hardware wallet companion apps. There is no separate persistence for it. The code waits inside the wallet until the owner opens it, then shows a convincing error page asking for the recovery phrase.
Kiriakoff draws the line clearly: cookies and passwords hurt but are recoverable, because sessions expire and credentials can be rotated. A recovery phrase cannot be revoked. Whoever holds it controls every wallet derived from that seed. The stealer also takes keychain secrets, Telegram sessions, and SSH and cloud keys.
Detect the behavior, and pause before you paste
Because the loader is polymorphic, hunting hashes is wasted effort. Dowd suggests building detection around curl invocations and Base64 content inside shell commands, and it is worth alerting on new LaunchAgents and on unexpected Full Disk Access or Screen Recording prompts, the two moments this chain cannot avoid asking permission. If the command did run, treat browser sessions, keychain contents, SSH keys and cloud credentials as exposed, rotate them, and move any cryptocurrency to a freshly generated seed.
The prevention is duller and better. Sponsored search results are not vetted, a page on a trusted domain can still be written by anyone, and a command you cannot read is a command you should not run.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.