Bybit Flags AI-Driven macOS Malware Campaign Targeting Developers Searching for Claude Code
Bybit has stepped into the cybersecurity spotlight with a detailed disclosure that reads more like a warning shot than a routine report. The cryptocurrency exchange revealed a coordinated malware campaign aimed at macOS users who searched for “Claude Code,” an AI development tool from Anthropic. The findings highlight a growing pattern: attackers are following developers, and they are doing it through search engines.
SEO Poisoning Leads the Attack Chain
The campaign began with a classic but effective tactic: search engine manipulation. Attackers pushed a malicious domain to the top of Google results. Users clicked what appeared to be a legitimate resource. Instead, they landed on a convincing imitation of official documentation.
This is where things turned serious. The fake page delivered a two-stage malware sequence. The goal was clear. Capture credentials. Access crypto assets. Maintain control over the system.
Stage One: Data Extraction at Scale
The first payload arrived as a Mach-O dropper, a file format used by macOS systems. It deployed an infostealer powered by osascript, a scripting interface native to macOS. The malware behaved in ways that mirrored known threats such as AMOS and Banshee.
Once active, it ran a layered obfuscation process. That process helped it avoid detection while extracting valuable data. This included browser-stored credentials, macOS Keychain entries, Telegram sessions, VPN configurations, and crypto wallet data.
Bybit’s team identified attempts to access more than 250 browser-based wallet extensions. Desktop wallet applications were also targeted. That level of reach signals intent, not experimentation.
Stage Two: Persistent System Control
The second payload raised the stakes. A C++-based backdoor introduced deeper system access and long-term persistence. It included sandbox detection features, allowing it to evade analysis environments.
The malware used encrypted runtime configurations and relied on HTTP polling to communicate with command-and-control servers. This approach reduced visibility and made detection harder.
Once embedded, it granted attackers remote command execution. In simple terms, they could control the infected machine from a distance.
AI Accelerates Threat Detection and Analysis
Bybit’s Security Operations Center did not rely on traditional workflows alone. The team used AI-assisted processes across the entire analysis cycle.
Initial classification of the malware sample took minutes. Behavioral similarities to known threats were flagged almost instantly. Reverse engineering of the second-stage payload, which could take hours, was completed in under 40 minutes.
Automated pipelines extracted indicators of compromise. These included file signatures, infrastructure details, and behavioral markers. Analysts validated the findings and deployed detection rules the same day.
The result was a significant reduction in response time. Bybit reported that overall analysis and reporting cycles were completed about 70 percent faster than standard methods.
Social Engineering Adds Another Layer
The campaign did not rely on code alone. It used psychological tactics as well. Fake macOS password prompts appeared during execution, encouraging users to enter credentials.
Attackers also attempted to replace legitimate wallet software with altered versions. Applications such as Ledger Live and Trezor Suite were impersonated and distributed through malicious infrastructure.
This combination of technical and human-focused tactics increases success rates. It also makes detection more difficult for average users.
Wide Attack Surface Across macOS Environments
The malware targeted multiple data sources within macOS systems. This included Chromium-based browsers, Firefox variants, Safari data, Apple Notes, and local file directories.
These locations often store sensitive information. Think saved passwords, private keys, and authentication tokens. For developers, the risk extends further. Access to code repositories and infrastructure credentials can lead to broader compromises.
Timeline Shows Rapid Response
Bybit identified the malicious infrastructure on March 12, 2026. Full analysis, mitigation steps, and detection rules were completed within the same day. Public disclosure followed on March 20, along with guidance for identifying and blocking the threat.
That turnaround time reflects a shift in how security teams operate. Speed now matters as much as depth.
Developers Remain High-Value Targets
This campaign highlights a simple truth. Developers sit at the center of modern digital ecosystems. They have access to code, systems, and financial tools. That makes them attractive targets.
Search behavior has become a new attack surface. Users trust top search results. Attackers know this. They exploit that trust with precision.
Bybit’s disclosure adds weight to a growing concern. As AI tools gain traction, attackers will follow the demand. Fake resources will appear where real users are looking.
The takeaway is direct. Verification matters. Sources matter. A single click can open the door to a multi-stage attack.
Bybit’s report serves as both a technical breakdown and a cautionary tale. AI is now part of both sides of the equation. Defense teams are using it to detect and respond faster. Attackers are using it to scale and refine their methods. That tension is not going away.
The industry is entering a phase where speed, accuracy, and judgment must work together. Tools can assist. Analysts must still decide. That balance will shape how future threats are handled.