LastPass Warns of Fake Repositories Infecting macOS with Atomic Infostealer

LastPass warns of a widespread campaign targeting macOS users through fake GitHub repositories that deliver malware-laced programs masquerading as legitimate tools. According to LastPass Threat Intelligence, Mitigation, and Escalation (TIME) team, the fraudulent repositories redirect victims to a repository that downloads the Atomic infostealer malware.

The campaign impersonates popular tools such as 1Password, Basecamp, Dropbox, Gemini, Hootsuite, Notion, Obsidian, Robinhood, and others, with all the GitHub pages designed to target macOS systems. Attacks rely on SEO poisoning to push malicious GitHub sites to the top of Bing and Google search results, guiding users to click an Install LastPass on MacBook button that redirects to a GitHub page domain.

The GitHub pages are reportedly created by multiple usernames to evade takedowns, and the redirected domain provides ClickFix-style instructions to copy and execute a Terminal command that deploys the Atomic Stealer malware.