Bybit, the world's second-largest cryptocurrency exchange by trading volume, has publicly disclosed a sophisticated, multi-stage malware campaign targeting macOS users searching for Anthropic's Claude Code AI development tool. The exchange's Security Operations Center (SOC) published its findings on April 21, 2026, detailing a campaign first identified in March 2026 that represents one of the first known disclosures by a centralized crypto exchange of an active threat routed through AI-tool discovery channels.
The attack chain began with search engine optimization (SEO) poisoning, where attackers pushed a malicious domain to the top of Google search results for "Claude Code" queries. Users were redirected to a spoofed installation page designed to mimic Anthropic's legitimate documentation. The initial payload was a Mach-O dropper that deployed an osascript-based infostealer with behavioral similarities to the AMOS and Banshee macOS stealer families.
The malware specifically targeted cryptocurrency assets, attempting access against more than 250 browser-based wallet extensions and multiple desktop wallet applications, including attempts to replace legitimate apps like Ledger Live and Trezor Suite with trojanized versions. It harvested sensitive data including browser credentials, macOS Keychain entries, Telegram sessions, VPN profiles, and cryptocurrency wallet information, using fake macOS password prompts to validate and cache user credentials.
A second-stage C++ backdoor added advanced capabilities including sandbox detection, encrypted runtime configuration, and system-level persistence. It enabled remote command execution via HTTP-based polling, granting attackers ongoing control of compromised devices while making detection more challenging due to its intermittent connection method.
Bybit's SOC leveraged AI-assisted workflows to dramatically accelerate its response. AI-assisted reverse engineering and control-flow analysis reduced the deep inspection time for the second-stage backdoor from an estimated six to eight hours to under 40 minutes. Automated extraction pipelines identified indicators of compromise, and AI-assisted rule generation supported the creation of threat signatures. According to Bybit, threat-intelligence outputs were finalized approximately 70% faster than in traditional workflows.
"As one of the first crypto exchanges to publicly document this type of malware campaign, we believe sharing these findings is critical to strengthening collective defense across the industry," said David Zong, Head of Group Risk Control and Security at Bybit. The exchange confirmed that malicious infrastructure was identified on March 12, with full analysis, mitigation, and detection measures completed within the same day, followed by public disclosure on March 20.
