Mac users beware scammers are hijacking Claude chats and Google ads to push malware

Date:
Tue, 12 May 2026 17:20:00 +0000

Description:
Fake Claude support pages are circulating, being advertised through Google Ads

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Crooks abused Claudes Shared Chats feature to plant fake install instructions leading to infostealer infections Fraudulent chats were promoted via Google Ads, showing authentic Claude URLs to trick Mac users Campaign used ClickFix tactics, spoofed Apple Support, and avoided targeting Russianlanguage systems Cybercriminals are abusing legitimate Claude and Google Ads services to trick Mac users into installing infostealing malware on their devices, experts have warned.

A new campaign was recently spotted, and disclosed, by security researcher Berk Albayrak on LinkedIn , concerning a feature called Shared Claude Chats, which allows users to create clickable links of previous conversations theyve had with the AI. That way, other people can view those specific chat sessions through a public URL. According to Albayrak, the hackers have created conversations in which the platform shows instructions on how to install Claude Code (a command-line coding assistant). However, the instructions are nothing but the standard ClickFix scam - they tell the user to bring up the Terminal and paste a command, which triggers a chain reaction resulting in an infostealer infection. Latest Videos From You may like 'Threat actors are clearly adapting to the widespread interest in popular AI tools': AI fans beware, hackers create a fake Claude site to spread backdoor malware Infostealers are being disguised as Claude Code, OpenClaw and other AI developer tools Be careful what you click - hackers use Claude Code leak to push malware Advertising the scam on Google The conversation was created by
an account named Apple Support, likely to increase its legitimacy. Those
with a shaper eye, however, could easily spot the trick, since the chat has a disclaimer at the top, warning the content below might be unverified or unsafe.

But creating the fraudulent conversation is just half the process - victims must still somehow land there.

Thats where Google Ads come in. The crooks were able to purchase ads on Googles advertising network, meaning people searching for Claude Code on Mac would be served this chat at the very top of the search engine results page. To make matters worse, those who would hover over the link or double-check where it leads, would see claude.ai - the authentic Claude URL.

Albayrak did not say how many people might have been compromised this way,
but BleepingComputer found the malware does not work on computers with
Russian language, suggesting that the miscreants are actively avoiding targeting Russians. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news and offers from other Future brands Receive email from us on behalf of our trusted partners
or sponsors By submitting your information you agree to the Terms &
Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/mac-users-beware-scammers-are-hijacking -claude-chats-and-google-ads-to-push-malware


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)