Crooks Hijack Google Ads and Claude AI Chat Links to Distribute Mac Malware

Introduction

A sophisticated malvertising campaign has been uncovered, where cybercriminals are manipulating Google Ads and abusing shared chat links from Claude.ai to trick Mac users into downloading malware. This deceptive operation targets individuals searching for a Mac version of Claude, Anthropic's popular AI assistant—which officially does not exist as a standalone desktop application. Instead of finding a legitimate download, victims encounter sponsored search results and cleverly crafted instructions that ultimately deliver malicious software onto their systems.

How the Malvertising Campaign Works

Abusing Google Ads

When a user types "Claude mac download" into a search engine, they may see sponsored results that appear to link directly to claude.ai. The displayed URL looks legitimate, often listing the official site. However, clicking the ad redirects the victim to a deceptive landing page controlled by the attackers. This page mimics the look and feel of Claude's official site but contains instructions for downloading a fake client, which actually downloads a trojanized installer.

Exploiting Claude.ai Shared Chats

To add a layer of credibility, the attackers leverage Claude.ai's legitimate shared chat feature. They create a chat conversation that includes step-by-step instructions for installing the so-called "Claude Mac app." This chat is then shared via a publicly accessible link. When victims land on the malicious ad page, they are redirected to this shared chat, which appears to come from Claude itself. The chat's content, authored by the attackers, instructs users to run a terminal command that downloads and executes the malware payload.

The Malware Payload: What You Need to Know

The malware delivered through this campaign is not yet publicly identified with a specific family, but early analysis suggests it is a backdoor capable of stealing sensitive data, monitoring activity, and granting remote access to the attacker's command-and-control server. The malicious installer, once executed, silently establishes persistence on the compromised Mac and begins exfiltrating credentials, browser cookies, and cryptocurrency wallets. Because the payload is downloaded via a seemingly trusted source (the shared Claude chat), many users lower their guard and follow the instructions without suspicion.

Implications for Users and Businesses

This campaign highlights the evolving tactics of cyber attackers who combine legitimate advertising platforms with trusted brand names to bypass traditional security filters. For individual users, the risk includes identity theft, financial loss, and compromise of personal data. For businesses, an infected employee Mac could lead to corporate network infiltration, data breaches, and regulatory fines. The use of Google Ads also undermines trust in search engine results, making it harder for users to distinguish genuine downloads from malicious ones.

Protecting Yourself from Such Threats

Best Practices for Safe Downloads

• Verify the source: Only download software from official websites or trusted app stores. For Claude, the only official distribution is through claude.ai in a web browser — there is no native Mac app.
• Inspect URLs: Before clicking an ad, hover over it to see the actual destination URL. Malicious ads often use lookalike domains or redirect chains.
• Be skeptical of sponsored results: Advertised links for software that doesn't officially exist are a huge red flag.
• Do not run unknown commands: Never execute terminal commands provided by a random chat, even if it appears from a trusted brand.

Detecting Malicious Ad Campaigns

1. Monitor network traffic: Use security tools that can detect unusual outbound connections to unknown IPs.
2. Check for unexpected processes: Activity Monitor can reveal suspicious background tasks installed by the malware.
3. Update antivirus definitions: While no AV is perfect, keeping definitions current increases the chance of detecting newer variants.

Additionally, always keep your macOS and apps up to date. Apple's built-in security features like Gatekeeper and Notarization can block some malicious software, but they are not foolproof against social engineering tricks used in this campaign.

Conclusion

The abuse of Google Ads and Claude.ai shared chats represents a dangerous new twist in malvertising. By exploiting trust in both search engines and AI chatbots, attackers are successfully luring Mac users into installing backdoors. Staying informed and exercising caution when downloading any software—especially from promoted links—remains the best defense. If you suspect your Mac has been compromised, run a full malware scan and consider contacting a cybersecurity professional.