Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Fake Claude Code Installation Command Steals Developer Credentials and Crypto Wallets
Excerpt
A malicious Google ad campaign is targeting macOS users searching for “how to install Claude Code on Mac,” using a convincing Claude-branded installation guide to deliver MacSync infostealer malware. The campaign steals developer credentials, browser sessions, SSH keys, cloud tokens, and cryptocurrency-wallet data. The attack does not exploit Anthropic systems or a software vulnerability. Instead, it abuses a familiar developer workflow: searching for a tool, clicking a…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | houstongaragedoorinstallers.com | High | Score 61/100 | First seen |
| Domain | mansfieldpediatrics.com | High | Score 58/100 | First seen |
| SHA256 | 720e1e04c2690ac14874d54823354d6bd06336b23e8458debaffeb2b18f5be6a | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…