Summary
Cybersecurity experts warn that a fake Claude Code install guide, promoted via a paid Google ad and hosted on a legitimate claude.ai share URL, is being used to deploy a six-stage macOS stealer called MacSync. This sophisticated malware can hijack crypto wallets by replacing legitimate Ledger and Trezor apps with Trojanized versions that phish recovery phrases.