Analysis of Apple Support Impersonation Campaign Using Google Ads and Claude Share

The post details a malicious campaign where threat actors used Google Ads to impersonate Apple Support, directing users to a fake 'Claude Share' page. The attack involved tricking victims into downloading and executing a malicious macOS installer disguised as a legitimate application. The malware, dubbed 'MacSync,' was designed to persist on infected systems and exfiltrate data.