Fake Claude Code ads distribute Atomic macOS stealer

Mate Research is tracking an active malware campaign running since at least May 2026 that uses sponsored search advertisements impersonating popular developer tools like Claude Code to distribute the Atomic macOS Stealer and persistent root backdoors. The campaign delivers payloads either through clipboard-swapping terminal commands or Apple-signed disk images that compromise cloud credentials, crypto wallets, and password managers. Open article →