A reported malvertising chain uses Google Ads and shared Claude chats to steer users toward a MacSync malware variant by making a fake developer-tool guide look routine.