Fake Malwarebytes, LastPass, and others on GitHub serve malware

A Malwarebytes report warns that fake versions of Malwarebytes, LastPass and other software are circulating on GitHub pages in a large-scale campaign aimed at Mac users, with Malwarebytes for Mac among the impersonated apps. The criminals’ goal is to distribute information stealers, with the Atomic Stealer (also known as AMOS) cited as the go-to malware for Macs, according to LastPass Threat Intelligence team.

The campaign often starts from a sponsored Google ad that points to GitHub instead of the official developer page, and search results can show deceptive listings unless users search carefully. If users click the deceptive “GET MALWAREBYTES” button, they are taken to a download page that instructs them to install the fake product, which functionally acts as an information stealer.

Malwarebytes notes a technical pattern in the installation steps, including a Bash command pipeline that downloads and executes a script from an external domain, a method that is blocked by Browser Guard in this case. For protection, ThreatDown and Malwarebytes for Mac detect and block this Atomic Stealer variant, and the article provides practical safety guidelines and post-infection steps.