# macOS malware and infostealer campaigns > Live situation record from CLSTR: https://clstr.news/situations/macos-malware-and-infostealer-campaigns > Updated: 2026-08-13T12:38:16.000Z. Sources: 9. Developments: 2. Security researchers have identified distinct macOS malware campaigns targeting user data and credentials. One campaign, dubbed ‘MacSync’ by Huntress, uses fraudulent Claude Code installation guides hosted on the legitimate claude.ai platform via Anthropic’s chat-sharing feature. By utilizing paid Google advertisements and deceptive display names like ‘Apple Support’, the attackers direct users to execute commands in the Terminal. This six-stage malware chain installs a stealer and a remote access Trojan, ultimately replacing legitimate cryptocurrency wallet applications with Trojanized versions to harvest seed phrases. Separately, Jamf Threat Labs identified ‘AmnesiaStealer’, a multi-stage infostealer written in Rust. This malware is distributed through counterfeit GitHub pages. It harvests sensitive information including the macOS keychain, Apple Notes, Telegram data, and browser credentials. A notable feature is its second-stage remote control module, which provides attackers interactive control over a victim’s Chromium browser to steal authenticated sessions and cookies via the DevTools Protocol. ## Timeline ### 2026-08-13: Jamf Threat Labs identifies AmnesiaStealer macOS malware Jamf Threat Labs has discovered AmnesiaStealer, a multi-stage Rust-based macOS infostealer that uses counterfeit GitHub pages to steal credentials, Apple Notes, and hijack browser sessions. 7 sources. https://clstr.news/cluster/jamf-threat-labs-identifies-amnesiastealer-macos-malware ### 2026-08-09: MacSync malware targets macOS users via fake Claude Code guides A sophisticated macOS malware campaign called MacSync uses fake Claude Code installation guides on claude.ai to steal cryptocurrency by hijacking Ledger and Trezor wallet apps. 3 sources. https://clstr.news/cluster/macsync-malware-targets-macos-users-via-fake-claude-code-guides --- Cite as: macOS malware and infostealer campaigns. CLSTR, https://clstr.news/situations/macos-malware-and-infostealer-campaigns