Homebrew Spoofing: Fake Installer Sites Use Clipboard Injection to Compromise macOS Developers

In October 2025, Kandji Threat Intelligence reported a malware campaign targeting macOS users via spoofed Homebrew installer sites that mirror brew[.]sh. The fake pages replace the normal copy-paste installation with a single “Copy” button, enabling attackers to inject hidden commands into the clipboard and download a malicious payload alongside the Homebrew installer.

Researchers identified at least four fake domains, including homebrewoneline[.]org, that imitate the official site with near-perfect accuracy and use embedded JavaScript to restrict copying while logging victim interactions to a notify.php endpoint. The same infrastructure hosting these sites has been linked to the Odyssey Stealer malware, and Kandji’s analysis suggests this spoofing effort may form part of a larger, commodity-style threat operation.

The firm emphasises that developers are prime targets because Homebrew and related tooling are heavily used in enterprise development environments, and it urges users to install only from the official brew[.]sh domain and to verify commands manually rather than using copy buttons or one-liners from untrusted sources. according to Kandji Threat Intelligence