Widespread Infostealer Campaign Targeting macOS Users

SecurityWeek reports a widespread campaign infecting macOS users by exploiting fraudulent GitHub repositories that impersonate well-known brands, including LastPass, to deliver the Atomic infostealer malware (AMOS). LastPass identifies two GitHub sites impersonating its brand that appeared on 16 September and have since been taken down, directing users to a page that instructs them to paste a command into a terminal, which then downloads an Update payload and installs AMOS in the Temp directory.

The actors are using SEO tactics and multiple fake GitHub usernames to mimic target brands and Mac-related terminology, with threats impersonating financial institutions, password managers, technology companies and others. The AMOS campaign has been active since at least July, and CrowdStrike noted an uptick in August in ads delivering a variant called SHAMOS. LastPass notes that the group also targeted Homebrew users in earlier campaigns by leveraging Google Ads and GitHub to hide malicious activity.