Weaponized Malware: GitHub Hosts Malware from Malwarebytes, LastPass, Citibank, SentinelOne, and More

A large-scale campaign targeting Mac users is leveraging fake GitHub pages to distribute information‑stealing malware disguised as popular legitimate applications, with impersonations spanning Malwarebytes for Mac, LastPass, Citibank, SentinelOne and many other well‑known brands.

Threat researchers from LastPass Threat Intelligence and Malwarebytes have identified numerous GitHub pages purporting to host macOS installers for trusted applications, sometimes backed by sponsored Google ads directing users to the malicious pages and by SEO‑poisoning to rank for queries like “Malwarebytes GitHub macOS.” Clicking a fake GET [APPLICATION] button delivers an

installer script from a newly registered domain, and the subsequent one‑line shell instruction shovels the script into macOS Terminal, bypassing prompts and macOS protections while installing persistent agents in LaunchAgents or LaunchDaemons. The operation aims to deploy the Atomic Stealer (AMOS), a macOS information stealer that harvests browser data, clipboard contents and stored credentials.

Although Malwarebytes for Mac and ThreatDown flag and block this variant, the social engineering remains shockingly effective against less cautious users.