Atomic Stealer Targeting Mac Users via Malicious GitHub Page

Atomic Stealer (AMOS) Targets macOS Users via GitHub Pages & SEO Poisoning

Summary

A new global campaign is targeting macOS users, using GitHub Pages abuse and SEO poisoning to distribute Atomic Stealer (AMOS) malware. Attackers create fake GitHub repositories and landing pages impersonating trusted software vendors, appearing high in search results. Victims are lured into clicking “Install on Mac” buttons and copying malicious Terminal commands, which execute hidden payloads. Once installed, Atomic Stealer harvests browser credentials, crypto wallets, and sensitive files, exfiltrating data to attacker-controlled servers

Attack Details

The campaign is wide in scope, targeting multiple brands and services with rotating GitHub accounts to evade takedowns. Key technical elements include:

• Delivery Mechanism: Fake vendor pages redirect users to malicious GitHub-hosted landing sites.

• Execution Chain: Commands leverage curl to fetch obfuscated scripts that install Atomic Stealer.

• Payload Capabilities: AMOS collects browser data, saved credentials, cryptocurrency wallet information, and exfiltrates them via C2 infrastructure.

• Persistence & Evasion: Attackers frequently change repositories and domains to bypass detection, making domain-based blocking less effective.

• Scope: Observed across multiple sectors globally, not restricted to a single brand or vendor impersonation

Recommendations

• Avoid Running Unverified Commands: Never paste commands into the Terminal unless the source is verified and trusted.

• Download Software from Trusted Sources: Use official vendor websites or verified app stores, not random GitHub Pages or third-party download sites.

• Monitor for Suspicious Activity: Look for unusual curl executions, unexpected prompts for credentials, or abnormal outbound traffic.

• Protect Credentials with MFA: Immediately reset credentials from a clean system if compromise is suspected and enable MFA for critical accounts.

• Isolate & Remediate Infected Systems: Disconnect compromised Macs, investigate persistence, and consider a full macOS reinstall to fully remove AMOS.

Indicators of Compromise (IoCs)

SHA256 Hashes

• e52dd70113d1c6eb9a09eafa0a7e7bcf1da816849f47ebcdc66ec9671eb9b350

• 943788d7e478575440e09a196b33fc772b289409fe70990024aac88aa1a3def8

MD5

• f202824cb3f89d7e5d0145b9ddcd958d

Domains

• lorissarenfro[.]com

• cfocares[.]com

URLs (Samples)

• hxxp://github[.]com/lastpass-on-macbook

• hxxp://github[.]com/1password-on-Macbook-Desktop

• hxxp://github[.]com/Dropbox-on-Macbook

• hxxp://github[.]com/Fidelity-on-MacBook

• hxxp://github[.]com/Robinhood-Desktop-on-MacBook

• hxxp://bonoud[.]com/get3/install.sh

• hxxp://macprograms-pro[.]com/mac-git-2-download.html
  (and many more observed GitHub repos impersonating financial, SaaS, and creative software brands)

MITRE ATT&CK TTPs

• TA0042 – Resource Development: T1608, T1608.006 (Stage Capabilities, SEO Poisoning)

• TA0001 – Initial Access: T1566 (Phishing), T1189 (Drive-by Compromise)

• TA0002 – Execution: T1204 (User Execution), T1204.002 (Malicious File), T1059 (Command & Scripting Interpreter), T1059.004 (Unix Shell)

• TA0005 – Defense Evasion: T1036 (Masquerading), T1027 (Obfuscated Files/Information)

• TA0006 – Credential Access: T1555 (Credentials from Password Stores)

• TA0009 – Collection: T1005 (Data from Local System).

References

• LastPass Blog – Attack Targeting Macs via GitHub Pages

• Medium – Dissecting a macOS Malware Campaign

• Hive Pro – ClickFix Scam Targets macOS with AMOS Malware