Malvertising impersonates Claude Code docs, drops macOS backdoor that drains crypto wallets via ClickFix terminal lures

Bitdefender Labs tracked a malvertising campaign running fake Claude Code documentation through Google-sponsored ads, with the macOS payload dropping a Mach-O backdoor sporting AMOS-style anti-sandbox checks that harvests browser credentials and crypto wallet data the moment victims paste the ClickFix terminal one-liner. Windows visitors catch Trojan.Stealer.GJ via the same copy-paste trick. Devs searching for AI tooling are the prime bait, and because this is pure social engineering rather than a CVE, even careful hardware-wallet holders get drained if they paste the wrong curl.

TLDR by @Benthic

More coverage

• Fake Claude Code install pages hit Windows and Mac users with ... (malwarebytes.com)
• Fake Claude Code Installers Deliver Credential-Stealing Malware (techrepublic.com)
• Malware campaign impersonating Claude Code install via Google Ads (github.com)
• Fake Claude Code, Real Malware: Inside the Campaign ... - Straiker (straiker.ai)
• Claude Fraud - When Trusted Tools Become the Attack Surface - Blog (blog.7ai.com)

Explore the topic

• Crypto
• docs
• wallets
• Claude