Attackers Use Phony GitHub Pages to Deliver Mac Malware

An emerging threat campaign is using targeted SEO poisoning to hit Mac users with infostealers, according to LastPass's Threat Intelligence, Mitigation, and Escalation (TIME) team. The group publishes GitHub repositories that claim to offer MacOS versions of legitimate software, then leverages SEO to ensure these fake pages rank highly in search results. LastPass said two fake listings from GitHub users offered “LastPass Premium on MacBook,” with the pages created on Sept.

16 and subsequently submitted for takedown and now inactive. The campaign has targeted a range of technology and financial-sector companies, including LastPass itself, and researchers noted the same approach has appeared in prior campaigns, such as one claiming a MacOS version of Homebrew.

The Atomic infostealer, also known as AMOS, is delivered via the process described, and LastPass highlighted that other related campaigns, including those attributed to Cookie Spider and SHAMOS, have involved malvertising and one-line installation commands.