Hackers Use Fake Google Docs and Claude AI Pages to Steal Crypto Wallet Data

Security firm Huntress reported that hackers are distributing malware by impersonating CoinDesk staff on X to lure users into opening malicious Google Docs. The campaign targets Mac users with Atomic macOS Stealer (AMOS) and Windows users with NetSupport RAT and fake Ledger applications. Additionally, malicious search ads for Claude.ai are being used to deploy MacSync and SectopRAT, while 16 malicious Chrome and Edge extensions have been identified for draining EVM, Solana, and Tron wallets.