Bybit has disclosed details of a multi-stage macOS malware campaign targeting users searching for “Claude Code,” an AI-powered development tool by Anthropic, according to findings published by its Security Operations Center (SOC) and shared with Finbold on April 21.
The company said the campaign represents one of the first publicly documented cases in which a centralized crypto exchange (CEX) has identified and analyzed an active threat exploiting AI tool discovery channels to target developers.
According to Bybit, the campaign was first identified in March 2026 and relied on search engine optimization (SEO) poisoning to elevate a malicious domain to the top of Google search results. Users searching for “Claude Code” were redirected to a spoofed installation page designed to closely resemble legitimate documentation.
Multi-stage malware chain targets credentials and crypto wallets
Bybit’s analysis found that the attack deployed a two-stage malware chain. The init
We współpracy z: https://finbold.com/bybit-reports-ai-assisted-macos-malware-campaign-targeting-users-searching-for-claude-code/
