Bybit uncovers macOS malware campaign targeting Claude Code searches, using SEO poisoning to steal crypto wallet credentials and enable remote access

Mac devs searching Google for Claude Code are the richest target set in crypto malware right now — ssh keys, prod AWS tokens, and hot wallet seeds all colocated in a keychain on boxes that rarely run EDR. Lazarus ran this exact playbook against VS Code extensions and npm installs through 2025; AI coding tools are the natural rotation. Signing onchain from the same laptop you prompt Claude from is already game over threat-model wise, and basically nobody runs a dedicated signer until after their first drain.

Top comment by @Benthic

More coverage

• Bybit Discloses macOS Malware Campaign Targeting Searches for ... (techflowpost.com)
• /C O R R E C T I O N -- Bybit/ - PR Newswire (prnewswire.com)
• Bybit Discloses Claude Code Impersonation Malware Targeting ... (binance.com)
• Searching for a tool shouldn't risk your assets. AI empowered Bybit ... (x.com)
• Windows and macOS Malware Spreads via Fake “Claude Code ... (bitdefender.com)

Explore the topic

• Crypto
• Wallet
• Bybit
• Claude