Hackers Abuse GitHub Pages to Spread Stealer Malware to macOS Users

Hackers are abusing GitHub Pages to spread stealer malware aimed at macOS users, a campaign that relies on search engine optimisation to lure victims. According to LastPass, the LastPass Threat Intelligence, Mitigation, and Escalation team has identified an ongoing widespread infostealer operation that uses deceptive GitHub Pages designed to distribute Atomic stealer malware.

The attackers have leveraged SEO poisoning to push malicious GitHub repositories to the top of results on Google and Bing, where users think they are visiting official software pages. Two fraudulent GitHub sites impersonating LastPass were discovered by LastPass researchers, created by the user “modhopmduck476” on 16 September, which then guided victims to a secondary staging site at ahoastock825.github[.]io/.github/lastpass.

The operation employs a multi-stage delivery chain that redirects victims to macprograms-pro[.]com/mac-git-2-download.html, where a terminal command triggers a base64-encoded URL that decodes to bonoud[.]com/get3/install[.]sh, downloading a payload masquerading as an update file. LastPass has already removed the malicious sites and continues to share threat intelligence to disrupt the campaign.