How a fake Claude Code installer delivered malware — and what to watch for on your own Mac

Based on public MacSync / SHub ClickFix research (2026). Read-only checks first. Never silent auto-clean.

Am I affected? Quick check

Run this in Terminal. It only reads and reports — it does not delete or modify anything.

#!/bin/bash
# macsync_check.sh — read-only indicator scan
echo "== Checking known MacSync persistence paths =="
for p in \
  "$HOME/Library/LaunchAgents/com.google.keystone.agent.plist" \
  "$HOME/Library/Application Support/UserSyncWorker/last_up"
do
  if [ -e "$p" ]; then
    echo "[FOUND] $p"
  fi
done

echo "== Checking known staging artefacts in /tmp =="
ls -la /tmp/.c.sh /tmp/osalogging.zip /tmp/shub_log.zip 2>/dev/null
ls -d /tmp/shub_* 2>/dev/null

echo "== Listing all user LaunchAgents for manual review =="
ls -la "$HOME/Library/LaunchAgents/" 2>/dev/null

If a flagged path exists — especially a com.google.keystone.agent.plist that is not a genuine Google install — treat the device as compromised. Do not just delete the file and move on.

Known indicators

• Persistence: ~/Library/LaunchAgents/com.google.keystone.agent.plist
• Staging: /tmp/.c.sh, /tmp/osalogging.zip, /tmp/shub_*
• Revoked Apple Dev Team ID (code-signed variant): GNJLS3UYZ4
• Delivery pattern: curl -kfsSL $(echo '<base64>' | base64 -D)

If a match is found

Exfiltration can complete in seconds. A trojanised Ledger Live install can remain compromised after the stealer is gone. From a clean secondary device:

1. Disconnect the affected Mac from the network.
2. Rotate passwords, sessions, SSH keys, cloud/K8s credentials, npm/PyPI tokens.
3. Review GitHub/GitLab and CI for unauthorized tokens or deploy keys.
4. If you use Ledger Live, move funds to a new wallet on a clean device.
5. Reimage — don’t “clean in place.”

Prevention going forward

• Install AI CLIs only via vendor docs typed into the address bar — never sponsored search ads.
• Treat base64 -D, command substitution, or curl -k install one-liners as red flags.
• Keep a continuous LaunchAgent/persistence watcher so a new item shows up on a timeline.

Full guide source: nightlatch-dev-prds/artifacts-2026-08-08/macsync-removal-and-launchagent-cleanup-guide.md