Atomic Stealer Malware Spreads Through Fake MacOS Software Pages

A new large-scale cyberattack is targeting Mac users through fake GitHub pages impersonating well-known companies.

The attackers create fraudulent repositories on GitHub that appear to offer legitimate software for macOS, according to LastPass. . In reality, the downloads redirect victims to a site that installs Atomic Stealer, also known as AMOS malware.

The researchers argued that the malware has been active since April 2023, stealing passwords and financial information from users.

“The threat actors are using Search Engine Optimization (SEO) to deliver links to their malicious sites at the top of search pages, including Bing and Google,” LastPass explained.

LastPass confirmed that its own brand was used in the scam. Two GitHub pages set up on September 16 impersonated LastPass and included links claiming to “Install LastPass on MacBook.”

These redirected users to another malicious page, which then instructed them to run a command in their Mac’s terminal. The command triggered a download that secretly installed the Atomic Stealer malware.

Both of these fake LastPass pages have since been taken down, but the attackers appear to be using multiple GitHub accounts to bypass removals.

“We are writing this blog post to raise awareness of the campaign and protect our customers while we continue to actively pursue takedown and disruption efforts,” LastPass said.

The campaign is not limited to LastPass. The company reports that hackers are attacking multiple business sectors which include technology businesses and financial organizations and password protection services.

The security team at LastPass distributes indicators of compromise (IoCs) to organizations for threat detection while the company tracks the situation and provides additional information.