Poisoned Pipeline

Poisoned Pipeline / Incidents / AS296

AS296 · 2026-09

MacSync via signed fake Claude Desktop installers on a lookalike download site

macOS softwareAI coding agentsInstaller / update channel

OpenSourceMalware (verified 19 Sep 2026; initial intel Jamf Threat
Labs): the lookalike download site claude-desktop.com serves signed and
notarized fake app installers — Claude Desktop, TeleGlass, RelayArc,
Antigravity lures — as DMG containers. A stage-one shell downloader
(helper.sh) inside each DMG pulls a JSON C2 config from a
jsdelivr-mirrored GitHub repo (daynotest/daynoteupd[a|t]) and stages
the DayNote Mach-O payload from anchorpost13.com /
download-storage.com, with beaconing and exfiltration to
onyxsable8.com. All lure DMGs are code-signed by Developer ID
Application: OSMAN ASTUR (Team ID 8T6UCTT38A) — an identity the
attacker enrolled themselves, so macOS installs without a Gatekeeper
warning. Same MacSync family as the ClickFix waves (Anvilogic, Jamf);
this wave swaps the paste-in-terminal trick for a hands-off signed
installer on a brandjacked download site. Lures impersonate AI
desktop apps.

Mapped techniques

supply-chain signed fake-installer distribution

T0136 · Initial Access · Brandjacking

claude-desktop.com impersonates Anthropic's Claude Desktop
download page; TeleGlass, RelayArc, and Antigravity lures
borrow other tool names.

T0110 · Resource Development · Advertise malicious artifact

The lookalike site advertises the fake installers as the real
developer tools.

T0215 · Defense Evasion · Enroll attacker-owned code-signing identity

Every lure DMG is signed and notarized by Developer ID
Application: OSMAN ASTUR (Team ID 8T6UCTT38A), so Gatekeeper
installs it with no warning; the identity is the attacker's
own, not a stolen vendor certificate.

T0207 · Defense Evasion · Skip or forge artifact integrity verification

Signature verification succeeds by design; nothing left for
the consumer to catch.

T0205 · Initial Access · Compromise a third-party CDN or hosted web asset

The stage-two fetch is mirrored through jsdelivr from a GitHub
repo, so the network sees a trusted CDN host.

post-supply-chain macOS victims executing the installers

T0159 · Execution · Malicious artifact execution

The signed DMG mounts and runs helper.sh through the bundled
helper; no terminal interaction needed.

T0172 · Execution · Runtime backdoor

The DayNote Mach-O payload beacons to onyxsable8.com under a
JSON config fetched at stage one.

Sources