'This marks a sophisticated evolution': Experts warn Claude feature hijacked by hackers to launch major malware campaign

Date:
Thu, 18 Jun 2026 18:40:00 +0000

Description:
Shared Chats is being abused to lend legitimacy to ClickFix campaigns targeting software developers.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Trend Micro found criminals abusing Claudes Shared Chats feature to spread infostealers via ClickFix and malvertising Fake Apple Support chats on claude.ai, promoted through Google Ads, tricked macOS developers into pasting malicious commands Anthropic
banned the accounts and disabled malicious conversations, promising further abuse mitigations Security researchers Trend Micro have detected criminals abusing a legitimate feature in Claude AI to trick software developers into downloading malware. The campaign also includes malvertising, as well as the tried-and-true ClickFix method.

The goal of the campaign is to infect software developers - primarily those building AI tools on macOS environment - with infostealers . Targets from Russian-speaking countries are spared, it seems, while the majority of the victims are located in Taiwan (30% of all traffic). This country is followed by Japan, Singapore, and the US. Latest Videos From Watch full video here: Scam accounts banned At the center of the attack is a feature called Shared Claude Chats, which allows users to create clickable links of previous conversations theyve had with the AI. These chats can then be shared with other people via a public URL. Crooks created conversations showing fake
Apple Support instructing the user how to install Claude Code (a command-line coding assistant).

However, the instructions are nothing but the standard ClickFix scam - they tell the user to bring up the Terminal and paste a command, which triggers a chain reaction resulting in an infostealer infection. You may like Mac users beware scammers are hijacking Claude chats and Google ads to push malware Experts warn Claude Chrome extension could let hackers hijack your online browsing 'Threat actors are clearly adapting to the widespread interest in popular AI tools': AI fans beware, hackers create a fake Claude site to
spread backdoor malware

The second step is to advertise these URLs to the right target audience,
which was being done via Google Ads. The miscreants were able to buy ads on Googles network and set them up so that anyone searching for Claude Code on Mac (or similar keywords) would be shown these URLs as the first result.

Since the sites are hosted on the claude.ai domain, there was nothing seemingly suspicious about the links. Are you a pro? Subscribe to our newsletter Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me
with news and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.

Trend Micro is not the first company to warn about this campaign. In mid-May this year, security researcher Berk Albayrak posted a new warning on
LinkedIn, detailing almost an identical campaign. Same approach, same targets and most importantly - same exclusions.

The researchers are saying Anthropic investigated and banned the accounts responsible and disabled the malicious shared conversations. The AI company
is allegedly implementing additional abuse mitigations. The best antivirus
for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/this-marks-a-sophisticated-evolution-ex perts-warn-claude-feature-hijacked-by-hackers-to-launch-major-malware-campaign


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)