Bybit’s Security Operations Center has uncovered a sophisticated macOS malware campaign targeting developers searching for Claude Code, an AI-powered coding tool from Anthropic, highlighting a growing intersection between AI adoption and crypto-focused cyber threats. The attack uses search engine manipulation to trick users into downloading malicious software that can steal credentials, access crypto wallets, and establish persistent control over infected systems.
Fake Claude Code Downloads Used to Infect Developers
Attackers are exploiting the popularity of Claude Code by pushing malicious links to the top of search results through SEO poisoning. Victims searching for the tool are redirected to fake websites designed to mimic official documentation, where they unknowingly download infected files. The attack chain is multi-stage and begins with a disguised installer that deploys malware immediately after execution.
Malware Targets Crypto Wallets and Sensitive Data
Once installed, the malware acts as an infostealer, extracting a wide range of sensitive data from the victim’s system.
This includes:
- Browser credentials and saved passwords
- macOS Keychain data
- Telegram sessions and VPN profiles
- Crypto wallet data and private keys
Bybit researchers identified attempts to access hundreds of crypto wallet extensions, showing that digital assets are a primary target of the campaign.
Advanced Backdoor Enables Persistent System Control
Beyond data theft, the malware deploys a secondary backdoor written in C++, allowing attackers to maintain long-term access to compromised devices.
The system includes:
- Encrypted communication with remote servers
- Sandbox detection to evade security tools
- Persistent system agents to survive reboots
This turns infected machines into ongoing access points rather than one-time targets.
AI Tools Become a New Attack Surface
This campaign reflects a broader trend where cybercriminals are targeting developers through AI tools and platforms. As tools like Claude Code gain adoption, attackers are exploiting trust in these systems to distribute malware more effectively. The strategy is simple but effective. Instead of hacking systems directly, attackers trick users into installing compromised tools themselves.
