Hackers Abuse Claude’s Official Website and Google Ads to Spread Malware

Attackers placed fake ‘Download Claude’ pages on claude.ai itself, using Claude’s Shared Chat and public Artifact features, and promoted them through paid Google Ads, according to Gen Digital research published October 26 and covered by Cyber Security News. Mac users who followed the pages' instructions pasted a Terminal command that installed the Atomic macOS Stealer (AMOS), which steals passwords, browser sessions and cryptocurrency wallets and can replace Ledger and Trezor apps with copies that ask for recovery phrases; a parallel Windows campaign delivered a remote-access payload.