ClaudeFix: In a case of peak 2026, we've come across a campaign involving shared Claude chats hosting #ClickFix instructions to distribute a macOS infostealer.
In this research for Zscaler Threat Hunting, I analyzed a malvertising campaign targeting users looking to download Claude, ironically through cleverly crafted shared Claude chats. The shared chats add a semblance of legitimacy with the label "Shared by Apple Support" (seen on the top right in the screenshot) - the TA likely achieved this by setting their display name in Claude as "Apple Support" leading to this tag when the shared chat is generated.
More details on the campaign and an analysis of the delivered #MacSync stealer at https://www.zscaler.com/blogs/security-research/claudefix-shared-claude-chats-meet-clickfix