LastPass Warns of New SEO Poisoning Attack Targeting Mac Users

LastPass warns of a new SEO poisoning campaign that targets Mac users via fraudulent GitHub repositories, with attackers leveraging top search results to lure victims into downloading malicious payloads masquerading as legitimate software. The campaign uses multi-stage redirection: victims click on repositories masquerading as installers, which redirect to a GitHub Pages link, then to mac-git-2-download.html, and finally to a site that instructs a Mac user to run a curl command that fetches a base64-encoded URL.

The decoded URL delivers a payload labelled “Update,” which is in fact Atomic Stealer (AMOS malware), capable of exfiltrating passwords, authentication data, wallets and cryptocurrency information, browser-stored credentials, and system metadata. According to LastPass, two GitHub pages impersonating LastPass were posted to GitHub by the user ‘modhopmduck476’ on 16 September, and the fraudulent repositories redirected potential victims to a repository that downloads the Atomic infostealer malware.

The TIME team has submitted takedown requests for the fraudulent GitHub pages, which are now inactive, but warns that similar impersonations are likely to reappear and urges users to verify download sources against official vendor sites.