AI-Empowered Bybit Security Team Uncovers macOS Malware Campaign Targeting Users Searching For ‘Claude Code’

by
Alisa Davidson

Printed: April 22, 2026 at 4:18 am Up to date: April 22, 2026 at 4:18 am

by Anastasiia O

Edited and fact-checked:
April 22, 2026 at 4:18 am

To enhance your local-language expertise, generally we make use of an auto-translation plugin. Please be aware auto-translation might not be correct, so learn unique article for exact data.

Cryptocurrency trade Bybit reported that its Safety Operations Middle (SOC) has recognized a fancy multi-stage malware operation focusing on macOS customers trying to find “Claude Code,” a synthetic intelligence-driven improvement instrument developed by Anthropic.

The disclosure is among the many first public circumstances by which a centralized cryptocurrency trade has detailed an energetic risk marketing campaign geared toward builders via AI instrument discovery channels, highlighting an growing intersection between cybersecurity intelligence and the digital asset sector.

In keeping with the findings, first detected in March 2026, the marketing campaign relied on search engine marketing (search engine optimization) manipulation to place a fraudulent area on the high of Google search outcomes. Customers had been redirected to a counterfeit set up web page designed to carefully replicate respectable documentation, initiating a two-stage an infection course of centered on credential theft, cryptocurrency asset publicity, and protracted system compromise.

The preliminary stage concerned a Mach-O dropper that deployed an osascript-based information-stealing part with behavioural similarities to recognized AMOS and Banshee malware variants. This system carried out a multi-layer obfuscation sequence designed to extract delicate data, together with browser credentials, macOS Keychain information, Telegram periods, VPN configurations, and cryptocurrency pockets particulars. Researchers at Bybit recognized focused entry makes an attempt involving greater than 250 browser-based pockets extensions in addition to a number of desktop pockets functions.

A second-stage payload launched a C++-based backdoor that includes superior evasion mechanisms, together with sandbox detection and encrypted runtime configuration. The malware established persistence via system-level brokers and enabled distant command execution through HTTP-based polling, permitting steady attacker entry to compromised techniques.

AI-Assisted Menace Evaluation And Accelerated SOC Response

Bybit’s SOC reported the usage of AI-assisted workflows all through the malware evaluation course of, which considerably diminished response occasions whereas preserving analytical depth. Preliminary classification of the Mach-O pattern was accomplished inside minutes, with automated techniques figuring out behavioural patterns in step with recognized malware households.

AI-supported reverse engineering and control-flow evaluation diminished the inspection time for the second-stage backdoor from an estimated six to eight hours to beneath 40 minutes. Automated extraction processes had been used to determine indicators of compromise, together with command-and-control infrastructure, file signatures, and behavioural patterns, which had been then mapped to established risk intelligence frameworks.

These capabilities enabled same-day deployment of defensive measures. AI-assisted rule technology facilitated the creation of detection signatures and endpoint safety guidelines, which had been reviewed by analysts previous to deployment. Automated drafting of reporting supplies diminished general manufacturing time for risk intelligence outputs by roughly 70% in contrast with typical workflows.

“As one of many first crypto exchanges to publicly doc any such malware marketing campaign, we consider sharing these findings is essential to strengthening collective protection throughout the trade,” stated David Zong, Head of Group Threat Management and Safety at Bybit in a written assertion. “Our AI-assisted SOC permits us to maneuver from detection to full kill chain visibility inside a single operational window. What used to require a crew of analysts working throughout a number of shifts — decompilation, IOC extraction, report drafting, rule writing — was accomplished in a single session with AI dealing with the heavy lifting and our analysts offering judgment and validation. Seeking to the longer term, we’ll face an AI battle. Utilizing AI to defend towards AI is an inevitable pattern. Bybit will additional enhance its funding in AI for safety, attaining minute-level risk detection and automatic, clever emergency response,” he added. 

The investigation moreover recognized social engineering methods, together with counterfeit macOS password prompts meant to seize and retailer person credentials. In sure circumstances, attackers tried to interchange respectable cryptocurrency pockets functions resembling Ledger Stay and Trezor Suite with trojanised variations hosted on malicious infrastructure.

The malware marketing campaign focused a number of environments, together with Chromium-based browsers, Firefox-based variants, Safari information shops, Apple Notes, and native file directories generally used for storing authentication or monetary data.

Bybit reported that a number of domains and command-and-control endpoints linked to the operation had been recognized and neutralised previous to public disclosure. The evaluation indicated the usage of intermittent HTTP polling slightly than persistent community connections, a method designed to cut back detection probability.

The incident is described as a part of a broader pattern by which attackers more and more exploit search engine manipulation and AI-related instruments to focus on builders, who are sometimes seen as high-value victims on account of their entry to software program techniques, infrastructure, and monetary platforms.

The malicious infrastructure was reportedly recognized on 12 March, with evaluation, mitigation, and deployment of detection measures accomplished the identical day. Public disclosure of the findings adopted on 20 March, accompanied by technical steerage for risk detection.

Alisa, a devoted journalist on the MPost, makes a speciality of crypto, AI, investments, and the expansive realm of Web3. With a eager eye for rising tendencies and applied sciences, she delivers complete protection to tell and interact readers within the ever-evolving panorama of digital finance.

Extra articles