According to CoinMeta, as disclosed by Huntress, hackers spread malware by forging Google Docs files, GitHub malicious files, and impersonating Claude.ai pages. Attackers disguised themselves as CoinDesk employees on X to induce users to install the malicious programs. Mac users are faced with threats such as Atomic, macOS, and Stealer. Windows users were pushed fake Google API Connector updates that implanted NetSupport RAT and impersonated Ledger applications. Hackers placed false advertisements on Bing to lure users to visit impersonated Claude.ai pages, where MacSync and Sectoprat could steal cookie, passwords, mnemonics, and payment card information. Socket identified 16 malicious extensions targeting Chrome and Edge, which can empty the assets in EVM, Solana, and TRON wallets.