How a fake Claude Code install guide delivered the MacSync malware
derivai.substack.com
A technical analysis of a live Google Ads malvertising campaign abusing Claude AI, Base64-obfuscated shell commands and trusted domains to deliver the MacSync infostealer.