Beware: GitHub repos distributing Atomic Infostealer on macOS

LastPass warns macOS users about fake GitHub repositories distributing malware disguised as legitimate tools, redirecting victims to download the Atomic infostealer macOS infostealer. According to LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team, the fraudulent repositories aim to trick potential victims into installing software for MacOS and are still active as the campaign continues.

The campaign uses SEO to push malicious sites to the top of Google and Bing results and targets tech firms, banks, and password managers, with two fraudulent GitHub repos promptly labelled for takedown and now inactive. Notably, the GitHub pages appear to be created by multiple GitHub usernames to get around takedowns, and the pages use headlines featuring “name of company” and Mac-related terminology to lure users.

The pages direct users to follow Terminal instructions in a ClickFix-style sequence, which installs the Atomic Stealer malware, with attackers impersonating popular macOS tools such as 1Password, Dropbox, Notion, and Shopify. Security teams have shared Indicators of Compromise for this campaign.