INC-2026-001: Fake “Claude for Mac” Malvertising Leads to a macOS Infostealer Compromise

Overview

In August 2026, a Sophos employee setting up a new macOS (Apple silicon) laptop searched a public web search engine for a desktop build of a legitimate AI-assistant application. The user clicked a malicious sponsored advertisement that impersonated the software vendor, and was redirected to a newly registered lure domain. The page presented a “ClickFix” social-engineering prompt instructing the visitor to copy a command into the macOS Terminal to complete the installation. The user followed the instruction and pasted the command.

The command was a loader that retrieved a multi-stage macOS infostealer from attacker-controlled infrastructure. Over a period of roughly two minutes the malware collected locally stored secrets, staged approximately 16.5 MB of data, exfiltrated it over HTTP to a command-and-control (C2) server, installed a privileged persistence mechanism disguised as an Apple system service, and deleted its staging directory to remove evidence. We assess the capability to be an AMOS-class macOS information stealer based on its behavior and artifacts.

The endpoint’s on-device antimalware was installed and running throughout, but it did not block the delivery, execution, persistence, or exfiltration. Detection came from Sophos MDR behavioral analytics, which flagged the malicious post-execution activity as it occurred, within the same two-minute window. The confirmed compromise was escalated to the Sophos internal incident response team later that day. The team isolated the endpoint and, together with IT, reset the affected user’s corporate credentials and active sessions within hours of the case being opened. The exposed developer personal access token was rotated as a further precaution, with rotation confirmed several days later.

A subsequent enterprise-wide threat hunt across the endpoint estate, together with a source-control audit of the exposed developer token, confirmed that the activity was confined to the single endpoint. No lateral movement was observed, and no abuse of the exfiltrated credentials was seen. SophosLabs analyzed the recovered samples, deployed global blocks for the attacker infrastructure, and released endpoint detection signatures for the malware components. The device was rebuilt and returned to service.

Impact

The impact of this incident was limited to a single internal Sophos endpoint. No Sophos customers, customer data, customer-facing systems, or Sophos products and services were affected.

Because the malware harvested locally stored data before it was contained, all secrets accessible from the affected user’s profile were treated as compromised. The harvested data included operating-system keychain contents, browser-saved credentials, password-manager vault data, cloud and developer access keys (AWS, Google Cloud, Docker, and FileZilla), SSH keys, a developer personal access token, messaging-application session data, shell and browser history. Approximately 16.5 MB of data was exfiltrated. As a precaution, every harvested item that could be rotated was rotated: the keychain contents, the browser-saved and password-manager-stored credentials, the cloud and developer access keys, the SSH keys, and the developer personal access token. Items that cannot be rotated — including the messaging-application session data and shell and browser history — were treated as disclosed.

The following were explicitly confirmed during the investigation:

No lateral movement from the affected endpoint to any other host was observed.
Enterprise-wide endpoint threat hunting identified no additional affected hosts (no co-victims).
An audit of the exposed developer personal access token found no evidence of misuse.
No customer or production environment was accessed, and no Sophos product or service was affected.

Timeline

Rows are mapped across the incident response lifecycle: detection and analysis, containment, eradication, and recovery.

Time (UTC)	Event	Actor
August 28, 2026 06:21 UTC	User searched a public web search engine for a macOS build of a legitimate AI-assistant desktop application.	User (Sophos employee)
August 28, 2026 06:21 UTC	User clicked a malicious sponsored advertisement impersonating the vendor and was redirected to a newly registered lure domain presenting a “ClickFix” prompt.	Threat actor
August 28, 2026 ~06:22 UTC	Following the on-page instructions, the user pasted a Terminal command that fetched a first-stage loader from attacker infrastructure.	User (Sophos employee)
August 28, 2026 06:22–06:24 UTC	A hidden Apple-silicon payload executed, collected local secrets, staged ~16.5 MB of data, exfiltrated it over HTTP to C2, installed a privileged LaunchDaemon disguised as an Apple system service, and deleted its staging directory.	Threat actor
August 28, 2026 06:22–06:24 UTC	Sophos MDR behavioural analytics detected the payload execution, credential and data collection, C2 communication, exfiltration, and persistence.	Sophos MDR (Detection & Analysis)
August 28, 2026 (morning)	MDR escalated the confirmed compromise to the Sophos internal incident response team; a case was opened and assigned for investigation.	Sophos MDR / IDR
August 28, 2026 ~13:55 UTC	The affected endpoint was isolated from the network via XDR.	IDR (Containment)
August 28, 2026 15:00 UTC	Corporate credentials and active sessions for the affected user were reset and revoked.	IT / IDR (Eradication)
August 28 – September 2, 2026	Live-response forensic triage was collected and analyzed by SophosLabs; an enterprise-wide XDR threat hunt and a source-control audit confirmed a single affected host with no lateral movement and no observed credential abuse.	IDR / SophosLabs
August 31, 2026 ~16:00 UTC	Rotation of the exposed developer personal access token was confirmed.	IT / IDR (Eradication)
September 2, 2026	SophosLabs deployed global blocks for the attacker infrastructure and released endpoint detection signatures for the malware components; the device was rebuilt, returned to service, and network isolation was lifted.	SophosLabs / IT (Eradication & Recovery)

Analysis

The observed activity is described below against the Lockheed Martin Cyber Kill Chain, covering only the phases actually observed, and framed where useful via the Diamond Model.

Reconnaissance and weaponization. The threat actor operated a malvertising campaign, purchasing sponsored search-engine advertisements that impersonated a legitimate AI-software vendor to target users searching for a macOS build of the application. Supporting infrastructure — a lure domain and payload-hosting and C2 servers — was registered shortly before the activity, consistent with disposable, campaign-specific infrastructure.

Delivery. Delivery was achieved through the malicious advertisement and lure page rather than an attachment or exploit. The lure page used the “ClickFix” technique: it presented plausible installation instructions that directed the user to paste a command into the macOS Terminal. This maps to the STIX Attack Patterns of user execution (MITRE ATT&CK T1204) and, at the delivery layer, spearphishing / malvertising via a service.

Exploitation. No software vulnerability was exploited. Exploitation targeted the user; the compromise depended on a human manually executing a command using trusted, built-in operating-system tooling (a command-line download utility piped into the default shell). Because no malicious file was written to disk for the anti-virus engine to scan at the point of delivery, signature-based on-device detection had nothing to act on at that stage.

Installation. The pasted command retrieved a first-stage loader, which fetched a hidden Apple-silicon executable, removed its quarantine attribute, made it executable, and ran it. Second-stage components were downloaded and given process names impersonating legitimate Apple system binaries (masquerading, T1036). Persistence was established by installing a LaunchDaemon with elevated privileges, named to impersonate an Apple accounts service (T1543.001).

Command and control, and actions on objectives. The malware communicated with an attacker HTTP C2 endpoint (T1071.001). It collected credentials and secrets from local stores (credentials from password stores, T1555; and unsecured credentials, T1552), staged them, and exfiltrated them over the C2 channel (exfiltration over C2, T1041). It then deleted its staging directory in an attempt to remove evidence (indicator removal, T1070).

Diamond Model. The adversary is characterized strictly by observed behavior: a financially motivated operator running a malvertising-to-infostealer campaign (STIX attack-motivation-ov: personal-gain / organizational-gain); no attribution to a named group is made or implied. The capability is an AMOS-class macOS information stealer (STIX Malware) with credential theft, masquerading, privileged-persistence, and anti-forensic behaviors. The infrastructure comprised sponsored-advertisement abuse, a newly registered lure domain, loader and second-stage hosting, and an HTTP C2 server (STIX Infrastructure). The victim was a single internal Sophos macOS endpoint and its user; no customer or production asset was in scope.

Why the controls behaved as they did. The delivery chain deliberately avoided the file-scanning path that signature-based endpoint protection relies on. The user was induced to execute trusted system utilities, and the infrastructure was freshly registered with no established reputation or signatures. On-device endpoint protection therefore did not block the chain. The behaviors that followed execution — a hidden binary running, bulk access to credential stores, outbound C2, large HTTP exfiltration, and privileged persistence — were exactly what Sophos MDR behavioral analytics is designed to detect, and detection occurred within the same two-minute window as execution. The layered behavioral / MDR control compensated for the gap in signature-based prevention, and the speed of that detection is what made containment and credential rotation possible within hours.

Resolution

Immediate actions

The affected endpoint was isolated from the network via XDR to stop further C2 communication and exfiltration.
All corporate credentials and active sessions for the affected user were reset and revoked, and the developer personal access token was rotated.
Live-response forensic triage (malware binaries, browser artifacts, and shell history) was collected and provided to SophosLabs for analysis.
An enterprise-wide XDR threat hunt was conducted across the endpoint estate, and the exposed developer token was audited in the relevant source-control platform. Both confirmed that the compromise was limited to the single host, with no lateral movement and no observed abuse of exfiltrated credentials.
SophosLabs deployed global blocks for the attacker’s C2 IP address and associated domains and released endpoint detection signatures for the identified malware components.

Longer term actions

The affected device was wiped, rebuilt, and returned to service after SophosLabs confirmed that forensic collection was complete.
Detection coverage for this delivery pattern was strengthened: the new detection signatures (published by SophosLabs as OSX/InfoStl-IH) and infrastructure blocks were rolled out, and behavioral detection of the post-execution activity was validated against the recovered samples.
A coverage gap was identified and is being closed: a browser-based identity-protection control was automatically deployed to Windows endpoints but required manual group assignment for newly enrolled macOS devices, so the new laptop had not yet received it. A tracked task was raised to automate deployment of that control to macOS devices at enrolment.
User-awareness guidance was reinforced, specifically that legitimate software installation never requires pasting a command copied from a web page into the Terminal — the core social-engineering step in the “ClickFix” technique.
We note the trade-off honestly: signature-based prevention cannot, by design, block a user’s manual execution of trusted operating-system tooling. The compensating controls for this class of attack are layered behavioral / endpoint-detection-and-response coverage, pre-deployed browser and identity protections, and user awareness — the combination of which contained this incident quickly and is being extended to close the gap that allowed initial execution.