Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads

According to Kandji’s security researchers, in September 2025 attackers deployed multiple spoofed Homebrew installer sites that perfectly mimic the official brew[.]sh page, targeting macOS users with a hidden malicious payload. In just one week, four malicious domains—such as homebrewoneline[.]org—resolved to the IP address 38.146.27[.]144, each presenting a flawless carbon copy of the Homebrew homepage.

Unlike the real site, these replicas restricted text selection and copying within the install command block, funneling victims to a single “Copy” button that surreptitiously loaded an attacker-injected command into the clipboard. The embedded JavaScript locks down the installation instructions and uses a clipboard-modifying function that writes a hidden command while the legitimate Homebrew install line runs, and a fetch to notify.php logs the click time and user environment. The campaign also distributed the Odyssey Stealer in parallel, combining credential theft with a persistent malware implant.