Security researchers at Trend Micro documented a malvertising campaign that abused Claude's shared-chat feature — the function that publishes a conversation at a real claude.ai link. Attackers ran Google Ads for popular AI tools, then sent people to genuine claude.ai pages showing a fake "Apple Support" chat that told them to paste a command into Terminal to fix an issue. The command installed an infostealer (on macOS, MacSync) that steals saved passwords, cookies and crypto wallets. The domain was real, the padlock genuine — so "check the URL" failed. The rule that still works: do not run commands supplied by an unexpected verification or repair page. Claude was not hacked; a feature was abused, and Anthropic disabled the malicious pages once notified.
Let me be honest before anything else: I use AI tools every day, and I think they're one of the most genuinely useful things to happen to ordinary work in a decade. That's exactly why this one unsettled me. The scam didn't fake a trusted website. It lived inside one.
The three rules we were all taught
If you've ever read a "how to stay safe online" guide — or written one, as we do — you know the core checklist by heart. It comes down to three habits:
This advice has protected people for two decades. Here's the uncomfortable part: in the campaign Trend Micro described, all three passed — and the danger was sitting on the other side of every one of them.
What actually happened, per Trend Micro
The mechanics are almost elegant, in the way the best cons are. People searched for an AI tool — Claude, ChatGPT's Codex, Perplexity, Cursor, JetBrains — and clicked an ad. The ad led to a link that was real: it opened on claude.ai, a domain your browser trusts, with no warning and a genuine padlock.
What loaded was a shared Claude conversation — the ordinary feature that lets anyone publish a chat as a public page on claude.ai. Except this conversation was dressed up as an "Apple Support" exchange, calmly walking the reader through "fixing" their problem by opening Terminal and pasting a single line. That line fetched and ran software that, by Trend Micro's account, emptied saved passwords, cookies and crypto wallets into the attackers' hands.
Notice what just failed. The address bar was right. The padlock was there. The brand was one you trust. Every signal we were taught to check passed — and that's not a flaw in the advice so much as the end of an era for it.
Why "check the URL" quietly stopped being enough
The old rules all share one hidden assumption: that a trustworthy place means a trustworthy message. For years that held, because hosting something on a real, reputable domain was hard for criminals to do. So "is this the real site?" was a decent proxy for "is this safe?"
What this campaign shows is that the proxy has broken. When a platform lets anyone publish a page on its trusted domain — a shared chat, a shared document, a hosted file — a scammer can rent that trust by the link. The certificate is real. The domain is real. Only the content is hostile, and content is the one thing the padlock was never checking.
The rule that replaces it
If the address bar can lie, you need a test that doesn't depend on where you are — only on what you're being asked to do. Here it is, and it's narrow on purpose:
A human-verification page should never require a Terminal or PowerShell command. Close an unexpected page that asks you to run one. Legitimate technical support can use commands, but its identity and the instructions must be verified through a support route you opened independently.
This is the heart of a technique researchers call ClickFix: the con doesn't sneak the malware past you, it talks you into installing it. By making you the one who runs the command, it can avoid a conventional installer or visible download warning. A command may be obscured to make its purpose hard to recognize. Running it can cause harm even when nothing obvious appears on screen; the outcome depends on what executed and which protections intervened.
For a fake “verify you are human” screen, use our fake CAPTCHA response guide. It separates seeing the page, copying text, downloading a file and running a command, with steps for Windows, Mac and phone users.
This isn't a reason to fear AI
It would be easy to file this under "see, AI is dangerous," and I don't think that's the honest read. The AI didn't do anything. A sharing feature — the same kind email, docs and chat apps have had for years — was pointed at a malicious page, and the moment researchers flagged it, Anthropic banned the accounts, took the malicious conversations down, and moved to tighten the feature against this abuse. That's roughly how the system is supposed to work.
What changed isn't that the tools turned on us. It's that "trust the source" — the instinct underneath every safety checklist most of us carry — needs its second half back. The source can be real and the request can still be poison. So judge the request.
If you take one habit from this piece, take this: a real domain is not a promise that what's on it is safe. The padlock secures the connection, not the content. The next time any page — however trusted its address — tells you to paste something into a terminal to "fix" or "verify" anything, you already know what it is. Close the tab, and go to the brand the way you'd find it yourself.
Saw a "paste this to fix it" page and not sure? Let's look at it together.
Send us the link and what it asked you to do. A real expert reviews every case and replies within 24 hours. Free, confidential, no pressure.
Common questions about the trusted-site AI scam
Was Claude or Anthropic hacked?
No. This is an important distinction. Per Trend Micro, attackers abused a legitimate feature — Claude's shared-chat pages, which let anyone publish a conversation at a real claude.ai link — to host their fake 'support' instructions on a trusted domain. No system was breached and no AI model was compromised. Once Trend Micro's researchers reported it, Anthropic banned the accounts, disabled the malicious shared conversations, and moved to add mitigations against shared-chat abuse. The lesson isn't that the tool is dangerous; it's that a trusted domain can be rented to host a lie.
How did a real claude.ai link end up showing a scam?
Claude, like many chat tools, lets you share a conversation as a public page hosted on its own domain. Attackers created conversations dressed up as an 'Apple Support' chat that instructed the reader to fix a problem by pasting a command into Terminal, then published those as shared links. They ran Google Ads for popular AI tools so that searching for one could surface an ad leading to one of these real-but-malicious claude.ai pages. To your browser the page is exactly what it claims to be — a genuine claude.ai URL with a valid certificate — which is precisely why it slips past every 'check the address bar' instinct.
What is ClickFix and why is it so effective?
ClickFix is a social-engineering technique where the victim is told to fix a supposed problem by copying a line of text and running it themselves — in Terminal on a Mac, or PowerShell/Run on Windows. It tries to make the victim execute the attacker's instruction directly; some attacks can run without a conventional installer or visible download warning. The command is usually obscured (often base64-encoded) so it looks like a harmless 'verification' step rather than what it is: an instruction to fetch and run hostile code.
What did the pasted command actually do?
According to Trend Micro, the command fetched and ran an infostealer — on macOS, malware tracked as MacSync — which harvests saved browser passwords and cookies, SSH keys, and cryptocurrency wallet data, then sends them to the attackers. We are deliberately not publishing the command or its structure. Treat execution as a potential compromise even if nothing obvious happens. The outcome depends on the command and the protections that intervened; the screen alone cannot establish what was stolen.
What's the one rule that still protects me?
A human-verification check should never require a command in Terminal or PowerShell. Close unexpected pages that demand one. Genuine technical support sometimes uses commands, so verify the support route and instructions independently before acting. A familiar host or logo does not establish that a user-published page is official support.
Sources & further reading
Every fact in this piece is drawn from these sources. Click any to verify.